Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Bingo

Bingo - command-line tool for everyday use

MIT-0 · Free to use, modify, and redistribute. No attribution required.
0 · 42 · 0 current installs · 0 all-time installs
bybytesagain4@xueyetianya
MIT-0
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The SKILL.md advertises a 'Bingo' toolkit (card generator, number caller, game management). The included script implements a generic devtools-style logging/export/search utility rather than explicit bingo-game functionality — the purpose described and the actual code diverge. This is likely a packaging/documentation mismatch.
Instruction Scope
Runtime instructions claim you can set BINGO_DIR to change the data directory, and SKILL.md describes gameplay features; the shipped script, however, hardcodes DATA_DIR=${HOME}/.local/share/bingo and does not read BINGO_DIR. The script reads/writes only under ~/.local/share/bingo and prints to stdout; it does not invoke network endpoints or access other system credentials.
Install Mechanism
No install spec is provided (instruction-only skill), and the code file is included in the bundle. Nothing is downloaded or extracted from external URLs. However, because there is no install step, the 'bingo' command will not be placed on PATH automatically — a user would need to install or symlink the script manually.
Credentials
The skill requests no credentials or environment variables. That is proportional. Minor inconsistency: SKILL.md documents a BINGO_DIR configuration env var, but the script ignores it (uses HOME-based path) — this is a behavior mismatch (not a secret-exfiltration issue).
Persistence & Privilege
The skill does not request permanent platform presence (always:false) and does not modify system-wide settings or other skills. It writes only to a per-user data directory under the home directory.
What to consider before installing
This skill appears to be a local CLI that stores logs and exports data under ~/.local/share/bingo and does not attempt network access or request secrets — that reduces risk. However: (1) the SKILL.md description (bingo game features, BINGO_DIR env var) does not match the shipped script (a generic logging/devtools script that hardcodes the data directory). Confirm the author and intended behavior before running. (2) Review the script yourself (it's included) for any unexpected commands; run it in a sandbox/container or with restricted permissions if you're unsure. (3) Be aware that any text you pass to the tool is appended to log files in your home directory (these logs may contain sensitive data). (4) If you expect an installable 'bingo' CLI, note there is no install spec — you will need to install/put the script on PATH yourself. If you want a cleaner verdict, ask the publisher for clarification about purpose, BINGO_DIR support, and an official install method.

Like a lobster shell, security has layers — review code before you run it.

Current versionv1.0.1
Download zip
latestvk97dj2ahh8xv42dxp4mznm2sj9830svf

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

SKILL.md

Bingo

Bingo toolkit — card generator, number caller, pattern checking, and game management.

Commands

CommandDescription
bingo helpShow usage info
bingo runRun main task
bingo statusCheck state
bingo listList items
bingo add <item>Add item
bingo export <fmt>Export data

Usage

bingo help
bingo run
bingo status

Examples

bingo help
bingo run
bingo export json

Output

Results go to stdout. Save with bingo run > output.txt.

Configuration

Set BINGO_DIR to change data directory. Default: ~/.local/share/bingo/


Powered by BytesAgain | bytesagain.com Feedback & Feature Requests: https://bytesagain.com/feedback

Features

  • Simple command-line interface for quick access
  • Local data storage with JSON/CSV export
  • History tracking and activity logs
  • Search across all entries

Quick Start

# Check status
bingo status

# View help
bingo help

# Export data
bingo export json

How It Works

Bingo stores all data locally in ~/.local/share/bingo/. Each command logs activity with timestamps for full traceability.

Support

Powered by BytesAgain | bytesagain.com | hello@bytesagain.com

Files

2 total
Select a file
Select a file to preview.

Comments

Loading comments…