Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
CAN: Clock Address Naming
v1.9.0Agent & MCP integration. CAN stamps what flows through any pipe. Verify, name, log locally.
⭐ 0· 1.6k·0 current·0 all-time
byxc@xccx
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (local timestamp/hash/name logging for MCP/tool outputs) matches the content of SKILL.md and the minimal requirements (sha256sum, date). The required binaries are exactly those needed to compute timestamps and SHA-256 hashes; no unrelated credentials, network endpoints, or system paths are requested.
Instruction Scope
SKILL.md instructs the agent to compute a timestamp and SHA-256 hash of tool outputs and append a TSV row to ~/.can/index.tsv (and optionally write the payload to ~/.can/store/$HASH). This stays within the stated local logging function. Caution: stamping will persist whatever the agent received (including secrets) to the local CAN store/index — that is expected behavior but a privacy concern the user should consider.
Install Mechanism
Instruction-only skill with no install spec and no archives/third-party downloads. No code is written to disk by the skill itself beyond the agent following simple shell commands; lowest install risk.
Credentials
No environment variables, credentials, or config paths are required. The SKILL.md examples reference only standard user-home locations (~/.can) and standard CLI utilities; requested access is proportional to the stated functionality.
Persistence & Privilege
always is false, the skill does not request forced/always-on presence, and it does not modify other skills or system-wide configs. The only persistent effect described is writing an append-only log under the user's home directory, which is consistent with the purpose.
Assessment
This skill is coherent and low-risk in itself: it only documents how to locally hash, timestamp, and record tool outputs. Before installing, consider: (1) privacy — any sensitive data returned by tools (API keys, secrets, PII) will be persisted in ~/.can/index.tsv and optionally ~/.can/store; restrict directory permissions and audit what the agent stamps; (2) storage growth — automated agents could write large or many blobs over time; consider retention/rotation; (3) platform compatibility — the SKILL.md assumes sha256sum is available (on some systems you may need shasum -a 256 or install coreutils); (4) agent autonomy — the skill examples show automated stamping of tool outputs; ensure the agent's policy about when and what to stamp matches your expectations. No scanner findings were produced because this is instruction-only; absence of findings is not a substitute for reviewing what your agent will actually log.Like a lobster shell, security has layers — review code before you run it.
agentvk978dt4ntsd02gpqr46vyw985h821xttair-gappedvk977b04vg9nk2hx83jrpe8dz0d81y2sxaudit-trailvk978dt4ntsd02gpqr46vyw985h821xttbroadcastvk97a4n9n6sae4b1s8hg6838qc981qqnpclock-addressingvk977b04vg9nk2hx83jrpe8dz0d81y2sxcontent-addressingvk97a4n9n6sae4b1s8hg6838qc981qqnpcontractvk977b04vg9nk2hx83jrpe8dz0d81y2sxfalsificationvk977b04vg9nk2hx83jrpe8dz0d81y2sxidentityvk977b04vg9nk2hx83jrpe8dz0d81y2sxlatestvk978dt4ntsd02gpqr46vyw985h821xttlatest security verify naming content-hash trustvk978y7vvzxyf0qbkhxpe13r24h80teenmcpvk978dt4ntsd02gpqr46vyw985h821xttnamingvk978dt4ntsd02gpqr46vyw985h821xttndnvk977b04vg9nk2hx83jrpe8dz0d81y2sxofflinevk97a4n9n6sae4b1s8hg6838qc981qqnpoffline-firstvk978dt4ntsd02gpqr46vyw985h821xttrinavk9744v1cyzbt5a28g898a41mph81x89hroutingvk977b04vg9nk2hx83jrpe8dz0d81y2sxsecurityvk977b04vg9nk2hx83jrpe8dz0d81y2sxsha256vk978dt4ntsd02gpqr46vyw985h821xtttrustvk977b04vg9nk2hx83jrpe8dz0d81y2sxverificationvk978dt4ntsd02gpqr46vyw985h821xttwotvk97a4n9n6sae4b1s8hg6838qc981qqnp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
❓ Clawdis
Binssha256sum, date