Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Skylv Commit Linter

v1.0.0

Validates git commit messages against conventional commits format. Triggers: commit lint, conventional commits, commit format.

0· 97·0 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for sky-lv/skylv-commit-linter.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Skylv Commit Linter" (sky-lv/skylv-commit-linter) from ClawHub.
Skill page: https://clawhub.ai/sky-lv/skylv-commit-linter
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install sky-lv/skylv-commit-linter

ClawHub CLI

Package manager switcher

npx clawhub@latest install skylv-commit-linter
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
high confidence
!
Purpose & Capability
Name and description promise automated validation/enforcement of Conventional Commits, but the SKILL.md contains only formatting rules and one example git command; there is no actual linting procedure, tool invocation, or dependency declared. The requested capabilities do not match the implementation (i.e., capability is claimed but not provided).
!
Instruction Scope
Runtime instructions are minimal and vague. The only actionable line is 'git log --oneline -20', which reads local git history (reasonable for this purpose) but does not implement validation, remediation, or explain what further commands are permitted. The vagueness grants broad agent discretion to choose how to 'validate', which is a scope creep risk.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk install footprint. Nothing is written to disk by an installer.
Credentials
No environment variables, credentials, or config paths are requested. The skill does not ask for unrelated secrets or broad access.
Persistence & Privilege
Does not request always-on presence and leaves autonomous invocation enabled (platform default). The skill does not request elevated system or cross-skill privileges.
What to consider before installing
This skill is incomplete rather than obviously malicious: it promises automatic commit-message linting but provides only guidelines and a single 'git log' command. Before installing or using it, ask the author for the concrete linting steps (e.g., which tool/command to run, any install steps such as npm install commitlint, or husky hooks). Require the skill to: 1) list exact commands it will execute, 2) disclose any packages it would install or network endpoints it would call, and 3) prompt before reading or transmitting repository data. If you need commit linting now, prefer well-known implementations (commitlint + @commitlint/config-conventional, or git hooks via husky) rather than this underspecified skill.

Like a lobster shell, security has layers — review code before you run it.

latestvk970dg4fhdfgbm77tjdv6z42pn856pr2
97downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Commit Linter

Overview

Validates commit messages and enforces conventional commits format.

Conventional Commit Format

type(scope): description

Types: feat, fix, docs, style, refactor, perf, test, chore

Valid Examples

feat(auth): add password reset fix(api): handle null response docs(readme): update install

Rules

  • Subject line max 72 characters
  • Use imperative mood ("add" not "added")
  • No period at end of subject
  • Separate subject from body with blank line

Validate

git log --oneline -20

Comments

Loading comments...