Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Multisage

v2.2.0

Query Multisage for multi-expert AI answers from Claude, GPT, and Gemini. Use this skill whenever the user wants multiple AI perspectives on a question, says...

0· 293·1 current·1 all-time
byM Waleed Kadous@waleedkadous
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The SKILL.md describes a Multisage CLI that contacts Claude/GPT/Gemini and therefore legitimately needs a network client and an API key; however the registry metadata lists no required environment variables or install steps, which is inconsistent with the runtime instructions.
!
Instruction Scope
Runtime instructions tell the agent to install a global npm package, check and export MULTISAGE_API_KEY, grep common dotfiles (.env, ~/.env) for the key, and write output to /tmp files — reading user dotfiles and echoing/exporting secrets is sensitive and broader than a minimal 'query API' instruction set.
Install Mechanism
No install spec is provided in the registry, but SKILL.md instructs users to run 'npm install -g multisage'. The absence of an official install spec or vetted package source in the registry metadata is a mismatch (not necessarily malicious, but worth verifying the npm package identity before installing).
!
Credentials
The skill requires an API key (MULTISAGE_API_KEY) according to SKILL.md, which is proportional to contacting a third-party API — but the registry metadata does not declare this required credential. Instructions to search local dotfiles for the key increases risk of accidental credential exposure.
Persistence & Privilege
The skill is instruction-only, always:false, and does not request persistent or platform-level privileges. It does not attempt to modify other skills or system-wide settings according to the provided material.
What to consider before installing
This skill appears to be what it claims (a wrapper around a Multisage CLI) but the package metadata in the registry is incomplete: SKILL.md clearly requires installing 'multisage' via npm and setting MULTISAGE_API_KEY, yet the registry lists no required env vars or installs. Before installing or using it: 1) Verify the official npm package name and publisher on npmjs.com and confirm it's the legitimate multisage package. 2) Prefer creating a restricted API key (if supported) rather than using a full-account key. 3) Avoid blindly running 'npm install -g' from unknown sources; consider installing in a sandbox or container. 4) Be cautious about commands that grep dotfiles (.env, ~/.env) or echo partial keys — these touch sensitive data. 5) Check Multisage's privacy/security documentation (rates, what content is sent to downstream providers) and confirm you are comfortable with the CLI sending prompts to external services. If possible, ask the skill author or registry maintainer to update the metadata to declare the required env var and any install steps so the registry and SKILL.md match.

Like a lobster shell, security has layers — review code before you run it.

aivk976t6t4k8yjjjshvxxtvhmwa182er4zconsultationvk976t6t4k8yjjjshvxxtvhmwa182er4zlatestvk976t6t4k8yjjjshvxxtvhmwa182er4zmulti-modelvk976t6t4k8yjjjshvxxtvhmwa182er4zresearchvk976t6t4k8yjjjshvxxtvhmwa182er4z
293downloads
0stars
1versions
Updated 6h ago
v2.2.0
MIT-0

Multisage Skill

Query the Multisage API for multi-expert AI answers. Multisage sends your question to Claude, GPT, and Gemini simultaneously, then synthesizes their responses into a single, well-rounded answer — highlighting where they agree, disagree, and what unique insights each provides.

Prerequisites

The multisage CLI must be installed globally:

npm install -g multisage

An API key is required. Get one at https://multisage.ai/settings (under "API Keys").

API Key Setup (Do This First)

Before running any multisage command, you must ensure MULTISAGE_API_KEY is available in your shell. The env var is often NOT inherited automatically — check and load it explicitly:

# 1. Check if it's already set
echo "${MULTISAGE_API_KEY:0:8}"

# 2. If empty, look for it in common locations
grep MULTISAGE_API_KEY .env 2>/dev/null || grep MULTISAGE_API_KEY ~/.env 2>/dev/null

# 3. Export it (replace with actual key found above)
export MULTISAGE_API_KEY="msk_..."

If you get a timeout or authentication error, the most likely cause is a missing API key — always verify it's set before debugging further.

Running from Claude (Important)

When running multisage from Claude or any non-interactive context, always use the -q flag to suppress the interactive spinner (doesn't render in tool output).

Redirect output to a file with > instead of piping through tee, which can cause issues in non-TTY contexts:

# Correct — redirect to file
multisage -q "your question" > /tmp/multisage-output.txt 2>&1
cat /tmp/multisage-output.txt

# Wrong — tee can cause issues in non-TTY contexts
multisage -q "your question" | tee output.txt  # DON'T DO THIS

Standard Query

For most questions, run a standard query. This consults all three AI providers and returns a synthesized answer with stage breakdown:

multisage -q "your question here"

The default output shows each stage: quick answer, expert synthesis, and debate (if the experts disagree). This costs 1 credit.

Deep Research

For questions that need thorough, in-depth analysis — research topics, complex technical questions, literature reviews — use deep research mode. This launches 3 parallel deep research sessions (one per provider) and synthesizes the results:

multisage -q --deep-research "your question here"

Deep research costs 5 credits and takes 5-25 minutes. The CLI streams progress updates as each provider completes. You can detach with Ctrl+C and check results later.

Output Options

FlagWhat it does
-qSuppress spinner (always use from Claude)
-f, --fullShow everything: quick answer, individual expert responses, synthesis, debate
--final-onlyShow only the final synthesized answer (skip stages)
-j, --jsonOutput as structured JSON
--deep-researchUse deep research mode (5 credits, 5-25 min)

Combine flags as needed. For example, -f -q gives full output without a spinner. -j gives structured JSON (useful if you need to parse the response programmatically).

Managing Deep Research

Deep research runs asynchronously. If you start one and need to check on it later:

# Check if results are ready
multisage results <threadId>

# Cancel an in-progress query
multisage cancel <threadId>

The threadId is printed when you start a deep research query.

When to Use Which Mode

  • Standard (multisage -q "...") — Good for most questions. Quick (30-90 seconds), costs 1 credit. Best for factual questions, advice, comparisons, code help.
  • Deep Research (multisage -q --deep-research "...") — For thorough analysis. Each provider does its own deep research with web search, then results are cross-referenced and synthesized. Best for research topics, technical deep-dives, market analysis, literature reviews.

Typical Usage from Claude

# Standard query — redirect to file, then read
multisage -q "What are the tradeoffs between SQLite and PostgreSQL for a hobby project?" > /tmp/ms-output.txt 2>&1
cat /tmp/ms-output.txt

# Full output (includes individual expert responses)
multisage -q -f "What are the tradeoffs between SQLite and PostgreSQL for a hobby project?" > /tmp/ms-output.txt 2>&1
cat /tmp/ms-output.txt

# Deep research
multisage -q --deep-research "What are the latest advances in protein folding prediction?"

# JSON output for parsing
multisage -q -j "Is Rust or Go better for CLI tools?" > /tmp/ms-output.txt 2>&1
cat /tmp/ms-output.txt | jq '.answer'

Response Structure

The API returns:

  • answer — Final synthesized answer
  • experts — List of expert names (or full details with -f)
  • creditsUsed — Credits consumed (1 for standard, 5 for deep research)
  • stages.quickAnswer — Initial quick answer before expert consultation
  • stages.synthesis — Synthesized answer incorporating all expert perspectives
  • stages.debate — Debate section highlighting disagreements (null if experts agree)

Limits and Errors

  • Questions are truncated to 1000 characters
  • 5-minute timeout for standard queries
  • API keys must start with msk_
  • Rate limit: 10 requests/minute, 3 concurrent
StatusMeaning
401Invalid or missing API key
402Insufficient credits — purchase at https://multisage.ai/pricing
429Rate limited or too many concurrent requests (check Retry-After header)
500Server error — try again

Troubleshooting

Timeout errors are almost always caused by a missing API key — the CLI makes an unauthenticated request that hangs instead of returning a clean error. Fix: verify MULTISAGE_API_KEY is exported (see API Key Setup above).

Diagnostic checklist (run these before retrying):

# Is the API key set?
[ -n "$MULTISAGE_API_KEY" ] && echo "Key set: ${MULTISAGE_API_KEY:0:8}..." || echo "KEY NOT SET"

# Is the CLI installed?
which multisage && multisage -V

# Quick connectivity test
multisage -q "hello" > /tmp/ms-test.txt 2>&1 && echo "OK" || echo "FAILED — check output:" && cat /tmp/ms-test.txt

Comments

Loading comments...