Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
OpenClaw Code Search
v1.0.0Provides fast, read-only codebase search and exploration using grep for content, glob for filenames, and tree for directory structure with filtering and limits.
⭐ 0· 371·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (read-only code search) match the included files and runtime behavior: a shell wrapper around ripgrep (rg), fd, and tree. There are no unrelated environment variables, credentials, or config paths requested.
Instruction Scope
SKILL.md and the script direct the agent to run a local shell script which performs filesystem searches. The script only reads files and directories (search path is an explicit parameter or current dir). This matches the declared purpose. Note: the tool will read any path you point it at (including system or user dirs) so results may include sensitive files if the agent is asked to search those locations.
Install Mechanism
There is no automated install spec in the registry (instruction-only behavior). The included DESIGN.md provides manual install suggestions, including GitHub release tarball downloads and package-manager commands; those sources are standard project releases. Nothing is automatically downloaded or executed by the registry install step.
Credentials
The skill requires no environment variables, no credentials, and no special config paths. All required runtime tools are standard CLIs (rg, fd, tree) and are checked at runtime by the script — proportional to the stated functionality.
Persistence & Privilege
The skill is not marked always:true and does not request persistent system-wide changes. It does not modify other skills or global agent configuration. Autonomous invocation is allowed (platform default) but combined with no extra privileges or credentials.
Assessment
This skill appears to be a straightforward, read-only code search wrapper around ripgrep/fd/tree. Before installing or using it: (1) Ensure you trust the agent workspace path used in examples (/root/.openclaw/...) or change it to a safe directory — the script will read any path you give it and could expose sensitive files if asked to search system or home directories; (2) The script checks for rg/fd/tree but does not install them automatically — DESIGN.md suggests curl downloads from GitHub releases if needed; only run those manual install commands if you trust the source and checksum; (3) The shell script parses rg --json using awk in a simplistic way (not a security issue per se, but parsing could mis-handle edge cases); (4) Autonomous agent invocation is allowed by default — if you want to limit when the agent can run filesystem searches, keep the skill user-invocable only or adjust agent policies. Overall the skill is coherent with its stated purpose, but avoid pointing it at directories containing secrets unless you intend to expose that data.Like a lobster shell, security has layers — review code before you run it.
latestvk97b0yyf2x32bvcharq757b2mx81xv6r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.