Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Polling Best Practices (J-Claw)
v2.0.0Best practices for automating long-running, asynchronous tasks via cron-style polling. Use when the user wants to monitor a background CLI command or API cal...
⭐ 0· 38·0 current·0 all-time
bySkywalker326@skywalker-lili
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims to be guidance-only with no runtime requirements, but the provided scripts and examples call the openclaw CLI (openclaw message send, openclaw agent), jq for parsing, and show example commands like nlm download. These binaries and their needed permissions are not declared in the skill's requirements, which is disproportionate and creates an expectation mismatch.
Instruction Scope
SKILL.md stays focused on polling best practices and includes explicit pre-flight confirmation, post-poll actions, and temp-folder rules. However it (and the template script) instruct the agent to send messages and trigger other agents via the openclaw CLI and to read task.json from disk; those actions cross into external communication and agent-chaining which require explicit user consent and available tooling. The guidance to 'skip confirmation if triggered by an upstream skill' is reasonable but expands execution scope when used in agent-chaining.
Install Mechanism
No install spec is present (instruction-only plus a script). That is low-risk from an installation perspective — nothing is downloaded or written by the installer itself.
Credentials
The skill requests no environment variables or credentials, but the script expects a CHAT_ID injected from inbound_meta and will invoke openclaw CLI commands that likely depend on the agent's configured credentials or tokens to send messages/trigger agents. This implicit credential/permission requirement is not declared and could lead to unexpected external notifications or agent triggers.
Persistence & Privilege
always:false (normal). The script can trigger other agents and send messages (openclaw agent / openclaw message send), which increases blast radius if the agent runs autonomously — but autonomous invocation is the platform default and is not by itself a disqualifier. No modifications to other skills or system-wide configs are requested.
What to consider before installing
This skill appears to provide useful, focused guidance and a working shell template, but it omits some practical runtime requirements. Before installing or running it: (1) Verify the agent environment has the openclaw CLI and any other utilities you plan to use (jq, nlm, etc.), and that those tools are authorized to post to your Discord/channel — otherwise notifications or agent triggers will fail or behave unexpectedly. (2) Review and sanitize any task.json or injected metadata to ensure no sensitive secrets will be read or transmitted. (3) Confirm you want automated notifications and agent-chaining (the script can send messages and trigger agents). (4) Ask the publisher to update the skill metadata to declare required binaries/permissions and any environment variables or credentials the script expects. These steps reduce the chance of accidental data exposure or unintended automated actions.Like a lobster shell, security has layers — review code before you run it.
latestvk976vy38s2fvby0jb6xyr4vcn983x4gq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.