ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

sitemd plugin

v0.1.1

Build and manage websites from Markdown. Create pages, generate content, configure settings, and deploy — all through MCP tools.

⭐ 0· 46·0 current·0 all-time
byTyler Berggren@tyler-berggren
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (markdown-based site builder) align with the SKILL.md, SOUL.md, and the included install script. The declared primary credential (SITEMD_TOKEN) is consistent with the documented API-key workflow for automated deploys.
✓
Instruction Scope
Runtime instructions are scoped to site management: reading pages/settings, creating pages, validating content, and performing authentication via magic links or API keys. Instructions do not request unrelated files, system-wide credentials, or arbitrary data exfiltration. They do instruct the agent to send a magic-link URL to the owner for login, which is expected behavior for this flow.
✓
Install Mechanism
The only code file is an installer (sitemd/install.js) that downloads a release from GitHub Releases (https://github.com/sitemd-cc/sitemd/releases/download), extracts it, and places a binary in ./sitemd/. Using GitHub Releases is a standard, low-to-moderate-risk install mechanism and is proportionate to the need to fetch a compiled binary.
✓
Credentials
Only a single primary environment credential (SITEMD_TOKEN) is declared, which matches the documented use (long-lived API key for automated deploys). No unrelated credentials or secrets are requested.
✓
Persistence & Privilege
always is false and the skill does not request elevated platform privileges or system-wide configuration changes. The installer writes a binary into the plugin's sitemd/ directory (expected for a binary-based tool) and does not modify other skills' configs.
Assessment
This skill appears coherent and does what it says: it manages Markdown websites and will download a sitemd binary from the project's GitHub releases into ./sitemd/. Before installing, verify you trust the sitemd project (https://sitemd.cc / the GitHub repo) and optionally inspect the downloaded binary or release artifacts. Only set SITEMD_TOKEN if you want automated, hands-off deploys — otherwise the magic-link flow requires the owner to complete login in their browser. If you have concerns about running downloaded binaries, run the installer in a sandbox or examine the release source on GitHub first.
✗
sitemd/install.js:52
Shell command execution detected (child_process).
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk977sbzvase0sq38k42006x8t984fpcq

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

Primary envSITEMD_TOKEN

Comments