Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
节点小宝管理
v1.0.0Manage 节点小宝 (Node Baby Link / JDxB) remote access service on Linux. Install, start/stop/restart the systemd service, check status, view logs, get pairing cod...
⭐ 0· 99·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The script implements install/start/stop/restart/status/logs/pair/uninstall for a JDxB-like service, matching the skill description. However, the SKILL.md recommends an "official" one-liner (https://iepose.com/install.sh) while the bundled script actually downloads binaries from http://cdn.ionewu.com and queries https://dpis.ionewu.com; the domain mismatch is unexplained and odd.
Instruction Scope
Runtime instructions tell the agent (and the user) to run the included shell script which, when run as root, writes a systemd unit, enables and starts a service, and downloads/extracts remote archives. The SKILL.md also explicitly suggests piping a remote install script to sudo bash (curl -sL https://iepose.com/install.sh | sudo bash). The script accepts an optional PID env var (not documented in SKILL.md) and contacts external endpoints to fetch an activation code. These instructions expand scope beyond local management into executing remote code and contacting external services.
Install Mechanism
There is no vetted install spec; the bundled script downloads a tgz from BASE_URL using plain HTTP (http://cdn.ionewu.com/...), extracts it, and executes start.sh from the archive. The SKILL.md additionally recommends a curl|bash installer from a different domain (iepose.com). Downloading unsigned binaries over HTTP and recommending piping remote scripts to sudo bash are high-risk practices.
Credentials
No credentials or env vars are declared, which is consistent with the declared metadata. The script does require root for install/service operations (expected for creating a systemd service). It will read an optional PID environment variable if present (PID override used when contacting the active-code endpoint) but SKILL.md does not document this optional env var.
Persistence & Privilege
The skill does not set always:true and is user-invocable. The script installs and enables a systemd service (normal for a daemon installer). It does not appear to modify other skills or global agent config.
What to consider before installing
This package appears to implement a manager for a remote-access service, but it asks you (or will run) to download and execute code from third-party hosts. Specifically: the bundled installer fetches a tarball over plain HTTP from cdn.ionewu.com and the skill suggests running a remote install script (curl ... | sudo bash) from iepose.com. Those are dangerous patterns because the downloaded code is unsigned, comes from domains unrelated to each other, and could be replaced or malicious. If you consider installing: 1) Do NOT run the curl|bash one-liner unless you fully trust the domain. 2) Inspect the downloaded tarball and start.sh contents in a sandbox before running as root. 3) Prefer HTTPS and verified releases (checksums / signatures). 4) Consider installing on an isolated VM/container first. 5) If you need pairing info, be aware the script contacts dpis.ionewu.com with parameters extracted from your local service—this transmits identifiers to that external host. If you can't verify the provenance of these domains or the binaries, treat this skill as risky and avoid installing it on production systems.Like a lobster shell, security has layers — review code before you run it.
latestvk97dzyxhdpsmwz8xfe741jej3983e00q
License
MIT-0
Free to use, modify, and redistribute. No attribution required.