Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Manus Monitor

v1.0.3

Create and manage AI agent tasks via Manus API. Manus is an autonomous AI agent that can browse the web, use tools, and deliver complete work products.

2· 1.4k·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The scripts and SKILL.md align with the stated purpose: they call the Manus API (MANUS_API_KEY), create tasks, poll status, download output files, and surface results. That capability legitimately needs the Manus API key and the ability to make HTTP requests and write local files.
!
Instruction Scope
Runtime scripts do more than the SKILL.md documents: they create scheduled cron jobs via the openclaw CLI, write and read local task/state files, and send Telegram messages. The SKILL.md does not mention Telegram notification environment variables (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) even though the scripts will use them if present. The scripts also log to /tmp and automatically start/stop monitoring when tasks are saved — behavior not fully described in SKILL.md.
Install Mechanism
There is no install spec (instruction-only), which reduces installer risk. However, the package includes multiple helper scripts that will be executed by the agent/cron; those scripts assume the presence of external tools (curl, jq, openclaw, date, mktemp) that are not declared in the registry metadata.
!
Credentials
Declared primary credential MANUS_API_KEY is appropriate. But the code expects additional environment variables (TELEGRAM_BOT_TOKEN, TELEGRAM_CHAT_ID) that are not declared in requires.env. Scripts also rely on openclaw CLI and jq/curl — these binaries are not declared. Unexpected or undeclared env usage is a red flag because it may cause accidental credential exposure or unexpected behavior if users set those envs.
Persistence & Privilege
The skill will create a recurring 'manus-task-monitor' cron job via the platform 'openclaw cron add' when a task is saved. always:false in the metadata is preserved, but the skill installs a persistent scheduled job that runs every minute until removed. This is a meaningful persistence capability and should be disclosed to the user (what the job does, what notifications it can send).
What to consider before installing
This skill largely does what its description promises (managing Manus tasks), but review the following before installing: 1) The package will create a recurring platform cron job that polls your Manus tasks every minute — confirm you want that persistent behavior. 2) The scripts will send notifications via Telegram if TELEGRAM_BOT_TOKEN and TELEGRAM_CHAT_ID are present; those env vars are not declared in the skill metadata, so only set them if you trust the skill and want notifications. 3) The scripts assume external tools (curl, jq, openclaw CLI, etc.) but these are not declared — ensure those binaries are present and you are comfortable with the agent using them. 4) The skill downloads output files from URLs returned by the Manus API and saves them locally; verify you trust the Manus service and the API key you provide. 5) There is a mismatch in the included _meta.json ownerId versus the registry owner; consider verifying the skill author/website (https://manus.im) and the publisher identity before granting credentials. If you proceed, only provide MANUS_API_KEY (and Telegram tokens only if you want notifications), and consider inspecting and running the scripts manually once to understand their behavior.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🤖 Clawdis
EnvMANUS_API_KEY
Primary envMANUS_API_KEY
latestvk973gfkxf8b3djdk0tmwpn5e0n80vytm
1.4kdownloads
2stars
4versions
Updated 2h ago
v1.0.3
MIT-0

Manus AI Agent

Use the Manus API to create autonomous AI tasks. Manus can browse the web, use tools, and deliver complete results (reports, code, presentations, etc.).

API Base

https://api.manus.ai/v1

Authentication

Header: API_KEY: <your-key>

Set via:

  • MANUS_API_KEY env var
  • Or skills.manus.apiKey in clawdbot config

Recommended Workflow

When using Manus for tasks that produce files (slides, reports, etc.):

  1. Create the task with createShareableLink: true
  2. Poll for completion using the task_id
  3. Extract output files from the response and download them locally
  4. Deliver to user via direct file attachment (don't rely on manus.im share links)

Create a Task

curl -X POST "https://api.manus.ai/v1/tasks" \
  -H "API_KEY: $MANUS_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "prompt": "Your task description here",
    "agentProfile": "manus-1.6",
    "taskMode": "agent",
    "createShareableLink": true
  }'

Response:

{
  "task_id": "abc123",
  "task_title": "Task Title",
  "task_url": "https://manus.im/app/abc123"
}

Agent Profiles

ProfileDescriptionUse for
manus-1.6Standard (default)Most tasks
manus-1.6-liteFaster, lighterQuick/simple stuff
manus-1.6-maxComplex, thoroughDeep research/analysis

Default: Always use manus-1.6 unless user specifies otherwise.

Task Modes

ModeDescription
chatConversational mode
adaptiveAuto-selects best approach
agentFull autonomous agent mode (recommended for file creation)

Get Task Status & Output

curl "https://api.manus.ai/v1/tasks/{task_id}" \
  -H "API_KEY: $MANUS_API_KEY"

Status values: pending, running, completed, failed

Important: When status is completed, check the output array for files:

  • Look for type: "output_file" entries
  • Download files from fileUrl directly
  • Save locally and send to user as attachments

Extracting Output Files

The task response includes output like:

{
  "output": [
    {
      "content": [
        {
          "type": "output_file",
          "fileUrl": "https://private-us-east-1.manuscdn.com/...",
          "fileName": "presentation.pdf"
        }
      ]
    }
  ]
}

Download these files with curl and deliver directly to the user rather than relying on share URLs.

List Tasks

curl "https://api.manus.ai/v1/tasks" \
  -H "API_KEY: $MANUS_API_KEY"

Best Practices

  1. Always poll for completion before telling user the task is done
  2. Download output files locally instead of giving manus.im links (they can be unreliable)
  3. Use agent mode for tasks that create files/documents
  4. Set reasonable expectations — Manus tasks can take 2-10+ minutes for complex work

Docs

Comments

Loading comments...