TOSR Test Skill

PassAudited by VirusTotal on May 6, 2026.

Overview

Type: OpenClaw Skill Name: tosr-test-skill-1778050421 Version: 0.1.0 The skill bundle consists of metadata and documentation (SKILL.md) intended for automated integration testing of the clawhub REST API. It contains no executable code, no sensitive data access, and no instructions that would lead to malicious behavior or prompt injection. The content is purely descriptive and aligned with its stated purpose as a temporary test artifact.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ConcernMedium Confidence
ASI02: Tool Misuse and Exploitation
What this means

If invoked with usable ClawHub access, the agent could create, change, or delete a skill listing rather than merely inspect information.

Why it was flagged

The skill explicitly directs lifecycle operations against the real ClawHub API, including publishing, updating, and deleting skill records, without defining approval gates, test-account limits, or rollback safeguards.

Skill content
This skill validates the following operations against the real clawhub API: ... Publish ... Update ... Delete — Removes the skill via DELETE /api/v1/skills/{slug}
Recommendation

Only run this in an isolated test account or CI environment, and require explicit confirmation plus a fixed test slug before any publish, update, or delete request.