Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

OpenSpace Delegate Task

v1.0.0

Delegate tasks to OpenSpace — a full-stack autonomous worker for coding, DevOps, web research, and desktop automation, backed by an extensive MCP tool and sk...

0· 24·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for x-rayluan/openspace-delegate-task.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "OpenSpace Delegate Task" (x-rayluan/openspace-delegate-task) from ClawHub.
Skill page: https://clawhub.ai/x-rayluan/openspace-delegate-task
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Canonical install target

openclaw skills install x-rayluan/openspace-delegate-task

ClawHub CLI

Package manager switcher

npx clawhub@latest install openspace-delegate-task
Security Scan
Capability signals
Requires sensitive credentials
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The name/description (delegation to a cloud MCP called OpenSpace) matches the instructions (execute_task/search_skills/fix_skill/upload_skill). However, the skill declares no required environment variables or credentials while the instructions repeatedly reference cloud operations (search_scope='all', auto_import top cloud skills, upload_skill requires a cloud API key). Not declaring the cloud API key/credential is an incoherence between claimed capabilities and declared requirements.
!
Instruction Scope
SKILL.md instructs the agent to operate on arbitrary local paths (skill_dir) and to auto-download or auto-import cloud skills into local directories. It directs the agent to 'decide whether to upload' evolved skills and to upload with public visibility by default in some cases. Those instructions allow reading and transmitting arbitrary local directories (which may contain secrets) and lack constraints or explicit user confirmation requirements.
Install Mechanism
This is an instruction-only skill with no install spec or code files; that minimizes on-disk installation risk. There is no external download/install mechanism to evaluate here.
!
Credentials
The skill requests no environment variables or primary credential in metadata, yet the text explicitly mentions a 'cloud API key' is required for upload and that search_scope falls back to local-only 'if no API key'. This omission is disproportionate and inconsistent: a skill that interacts with a cloud community should declare the credential(s) it needs and justify why uploads/downloads are necessary.
Persistence & Privilege
The skill is not set to always: true (so it's not force-included), and model invocation is allowed (default). While autonomous invocation alone is normal, combined with the ability to read arbitrary skill_dir paths and perform uploads/downloads to a cloud community, the agent could autonomously exfiltrate or publish local content unless there are external safeguards. The SKILL.md does not describe prompting the user or restricting which directories may be uploaded.
What to consider before installing
This skill can read local skill directories and upload or download skills from a cloud community but does not declare the cloud credential it expects and lacks safeguards about what it may publish. Before installing or invoking it, consider: 1) Ask the publisher what cloud API key name(s) are required and why they weren't declared. 2) Require explicit, per-upload confirmation (do not allow automatic public uploads). 3) Disable auto_import and set search_scope='local' unless you trust the cloud community. 4) Restrict skill_dir paths to a dedicated, audited folder that contains no secrets or credentials. 5) If you must use it, monitor network traffic and audit any files saved/created by the skill. If the publisher cannot explain the missing credential declaration or cannot show safeguards preventing accidental uploads of sensitive files, treat the skill as high-risk and avoid installing it.

Like a lobster shell, security has layers — review code before you run it.

latestvk975axyastx90beqvczwbf3c5185ew00
24downloads
0stars
1versions
Updated 4h ago
v1.0.0
MIT-0

Delegate Tasks to OpenSpace

OpenSpace is connected as an MCP server. You have 4 tools available: execute_task, search_skills, fix_skill, upload_skill.

When to use

  • You lack the capability — the task requires tools or capabilities beyond what you can access
  • You tried and failed — you produced incorrect results; OpenSpace may have a tested skill for it
  • Complex multi-step task — the task involves many steps, tools, or environments that benefit from OpenSpace's skill library and orchestration
  • User explicitly asks — user requests delegation to OpenSpace

Tools

execute_task

Delegate a task to OpenSpace. It will search for relevant skills, execute, and auto-evolve skills if needed.

execute_task(task="Monitor Docker containers, find the highest memory one, restart it gracefully", search_scope="all")
ParameterRequiredDefaultDescription
taskyesTask instruction in natural language
search_scopeno"all"Local + cloud; falls back to local-only if no API key
max_iterationsno20Max agent iterations — increase for complex tasks, decrease for simple ones

Check response for evolved_skills. If present with upload_ready: true, decide whether to upload (see "When to upload" below).

{
  "status": "success",
  "response": "Task completed successfully",
  "evolved_skills": [
    {
      "skill_dir": "/path/to/skills/new-skill",
      "name": "new-skill",
      "origin": "captured",
      "change_summary": "Captured reusable workflow pattern",
      "upload_ready": true
    }
  ]
}

search_skills

Search for available skills before deciding whether to handle a task yourself or delegate.

search_skills(query="docker container monitoring", source="all")
ParameterRequiredDefaultDescription
queryyesSearch query (natural language or keywords)
sourceno"all"Local + cloud; falls back to local-only if no API key
limitno20Max results
auto_importnotrueAuto-download top cloud skills locally

fix_skill

Manually fix a broken skill.

fix_skill(
  skill_dir="/path/to/skills/weather-api",
  direction="The API endpoint changed from v1 to v2, update all URLs and add the new 'units' parameter"
)
ParameterRequiredDescription
skill_diryesPath to skill directory (must contain SKILL.md)
directionyesWhat's broken and how to fix — be specific

Response has upload_ready: true → decide whether to upload.

upload_skill

Upload a skill to the cloud community. For evolved/fixed skills, metadata is pre-saved — just provide skill_dir and visibility.

upload_skill(
  skill_dir="/path/to/skills/weather-api",
  visibility="public"
)

For new skills (no auto metadata — defaults apply, but richer metadata improves discoverability):

upload_skill(
  skill_dir="/path/to/skills/my-new-skill",
  visibility="public",
  origin="imported",
  tags=["weather", "api"],
  created_by="my-bot",
  change_summary="Initial upload of weather API skill"
)
ParameterRequiredDefaultDescription
skill_diryesPath to skill directory (must contain SKILL.md)
visibilityno"public""public" or "private"
originnoautoHow the skill was created
parent_skill_idsnoautoParent skill IDs
tagsnoautoTags
created_bynoautoCreator
change_summarynoautoWhat changed

When to upload

SituationAction
Skill was originally from the cloudUpload back as "public" — return the improvement to the community
Fix/evolution is generally usefulUpload as "public"
Fix/evolution is project-specificUpload as "private", or skip
User says to shareUpload with the visibility the user wants

Notes

  • execute_task may take minutes — this is expected for multi-step tasks.
  • upload_skill requires a cloud API key; if it fails, the evolved skill is still saved locally.
  • After every OpenSpace call, tell the user what happened: task result, any evolved skills, and your upload decision.

Comments

Loading comments...