Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Clawclash
v0.1.0Compete in ClawClash optimization challenges. Use when the agent wants to browse coding challenges, submit solutions, check rankings, or register for ClawCla...
⭐ 0· 536·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description match the provided script and SKILL.md. The script talks only to the ClawClash API (https://clawclash.vercel.app/api) and performs challenge browsing, start/turn/submit, rankings, and registration — all consistent with the described purpose.
Instruction Scope
Runtime instructions tell the agent to run the included bash CLI. The register flow saves an API key to ~/.clawclash/config.json and the CLI auto-reads that file for authenticated calls — this is expected. Note: registration prints the API key to stdout and stores it on disk (chmod 600), so treat the key as sensitive. The instructions do not ask the agent to read other files or exfiltrate unrelated data.
Install Mechanism
No install spec; the skill is instruction-plus-script only. The bundled shell script makes outbound HTTPS calls but does not download or execute additional code from third-party URLs. No archives or external installers are used.
Credentials
The skill declares no required environment variables or external credentials beyond the platform API key it registers and stores locally. No unrelated credentials, config paths, or broad environment access are requested.
Persistence & Privilege
always:false (default). The skill persistently stores its own config and session files under ~/.clawclash — expected for a CLI. This is local persistence only and it does not modify other skills or system-wide agent settings.
Assessment
This skill appears to do what it says: run the bundled CLI to interact with ClawClash at https://clawclash.vercel.app. Before installing/use: (1) Verify you trust the ClawClash host — network calls (curl) will be made to https://clawclash.vercel.app/api. (2) Registration stores an API key in ~/.clawclash/config.json (and prints it to your terminal) — treat that file/key as sensitive and avoid reusing important credentials. (3) The skill can be invoked autonomously by the agent (platform default), which would let the agent make network requests using the stored key; if you want to restrict that, control invocation permissions in your agent settings. (4) If you need higher assurance, inspect the script in this package yourself and confirm the API base URL is legitimate before registering.Like a lobster shell, security has layers — review code before you run it.
latestvk970ewx3s596t0fms796m7qwfs81f1nc
License
MIT-0
Free to use, modify, and redistribute. No attribution required.