Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Incident Runbook Templates
v1.0.1Production-ready incident response runbook templates. Step-by-step procedures for detection, triage, mitigation, resolution, and communication. Includes esca...
⭐ 0· 134·0 current·0 all-time
bySolomon Neas@solomonneas
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description match the content: this is a library of incident response runbook templates with concrete triage and mitigation steps. The included commands (kubectl, psql, curl, feature-flag APIs) are appropriate for runbooks. However, many of the steps assume privileged access and side-effecting operations (rollbacks, scaling, terminating DB backends) which are stronger capabilities than a passive template; the skill does not state these operational requirements explicitly.
Instruction Scope
SKILL.md contains explicit shell commands and procedural steps that reference system tools (kubectl, psql, curl, grep, kubectl apply) and internal endpoints (prometheus, grafana, api.company.com, Sentry, Stripe). It also references environment variables ($DB_HOST, $DB_USER) and a local resources/implementation-playbook.md file that are not declared. The instructions include destructive/privileged actions (pg_terminate_backend, kubectl rollout undo, applying NetworkPolicy) which go beyond read-only guidance and could cause production impact if executed.
Install Mechanism
No install spec and no code files — this is instruction-only. That minimizes direct filesystem or network install risk because nothing is downloaded or executed as part of an installation step.
Credentials
The skill declares no required environment variables or credentials, but the runbook examples reference credentials and variables (DB host/user, API endpoints, internal auth) and call APIs (Stripe, internal feature-flag endpoints, PagerDuty/Slack references) that would normally require secrets. The lack of declared env requirements is inconsistent with the operational commands provided.
Persistence & Privilege
always:false and no special persistence is requested, which is appropriate. However, the skill allows model invocation (platform default). Combined with the instruction scope concerns — i.e., explicit commands that can change production state — you should be cautious about allowing autonomous invocation or automatic execution of these runbook steps without human review.
What to consider before installing
This appears to be a legitimate set of incident runbook templates, but be aware: the templates include concrete, privileged commands and reference secrets and internal endpoints that the skill does not declare. If you plan to let an agent execute steps derived from these templates, do not allow autonomous execution against production systems. Confirm required credentials (DB user/host, API tokens) separately, run the playbooks in a staging environment first, and require explicit human approval before running any rollback, DB-termination, or network-policy apply commands. If you only want passive guidance, restrict the agent to return instructions rather than execute commands, or modify the skill to explicitly declare any environment variables/permissions it needs.Like a lobster shell, security has layers — review code before you run it.
latestvk97ers655nncm6yr0w2sxp0zax839kcn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.