ClawHub
Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

StitchFlow Legacy Alias

v1.3.0

Legacy compatibility alias for StitchFlow. Use when a user explicitly references stitch-design-local, or when older prompts and setups still call that skill...

⭐ 0· 96·0 current·0 all-time
by@yshishenya
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description state this is a backward-compatibility alias and the SKILL.md simply redirects to the canonical 'stitchflow' workflow and toolkit; no unrelated capabilities, binaries, or credentials are requested.
ℹ
Instruction Scope
The SKILL.md instructs the agent to read ../stitchflow/SKILL.md and to use the toolkit at ${STITCH_STARTER_ROOT:-$HOME/.agents/stitch-starter}. That means the agent will consult another skill's files and an on-disk toolkit; this is expected for an alias but it does reference filesystem paths and an environment variable not declared in metadata.
ℹ
Install Mechanism
Registry metadata shows no install spec (instruction-only), but the SKILL.md contains an 'install: "bash install.sh --target all"' line. There is no bundled install script in this skill, so the line is an instruction/placeholder pointing to the canonical skill's install rather than an actual installer here.
ℹ
Credentials
The skill declares no required env vars, yet SKILL.md references STITCH_STARTER_ROOT and $HOME as the default toolkit path. This is proportionate to a local-toolkit workflow but is a mismatch between declared requirements and referenced environment variables.
✓
Persistence & Privilege
Flags show no 'always' privilege and autonomous invocation is allowed by default. The skill does not request persistent or system-wide privileges.
Assessment
This skill is a thin compatibility alias that tells the agent to follow the canonical StitchFlow skill and to use a local toolkit path (defaults to ~/.agents/stitch-starter). Before enabling: (1) verify the canonical 'stitchflow' skill and its SKILL.md exist and are trustworthy, (2) inspect any install.sh or toolkit contents before running them, and (3) be aware the alias may read sibling skill files and the toolkit directory (and it references STITCH_STARTER_ROOT and $HOME). If you don't trust the canonical skill or the toolkit path, do not enable this alias.

Like a lobster shell, security has layers — review code before you run it.

claude-codevk970wds6b7gytqe1zt99mvq7jh836bnncodexvk970wds6b7gytqe1zt99mvq7jh836bnndeprecatedvk975m1wzgenq4s64dxre8sqwex837ks0designvk975m1wzgenq4s64dxre8sqwex837ks0latestvk975m1wzgenq4s64dxre8sqwex837ks0legacyvk975m1wzgenq4s64dxre8sqwex837ks0openclawvk975m1wzgenq4s64dxre8sqwex837ks0prompt-to-htmlvk970wds6b7gytqe1zt99mvq7jh836bnnstitchvk975m1wzgenq4s64dxre8sqwex837ks0stitch-sdkvk970wds6b7gytqe1zt99mvq7jh836bnntailwindvk970wds6b7gytqe1zt99mvq7jh836bnnuivk975m1wzgenq4s64dxre8sqwex837ks0

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments