Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Mood Simulator

v0.4.0

情绪状态模拟器v4:评估用户当前情绪状态、能量水平、专注度,支持实时情绪追踪。触发条件:情绪转折、能量变化、专注度调整。

0· 96·0 current·0 all-time
byLouis Z.@zhaoguoqiang-hub

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for zhaoguoqiang-hub/mood-simulator.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Mood Simulator" (zhaoguoqiang-hub/mood-simulator) from ClawHub.
Skill page: https://clawhub.ai/zhaoguoqiang-hub/mood-simulator
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install mood-simulator

ClawHub CLI

Package manager switcher

npx clawhub@latest install mood-simulator
Security Scan
VirusTotalVirusTotal
Pending
View report →
OpenClawOpenClaw
Suspicious
high confidence
Purpose & Capability
Overall functionality (calculate time/content/history factors, classify states, track/track signals) aligns with the 'Mood Simulator' purpose. However package.json references files that are not present (main: scripts/mood.js, bin: bin/soul_mood.js) and package.json/package-lock.json versions differ from registry metadata. These packaging inconsistencies suggest sloppy packaging or mismatched source, and reduce confidence that the bundle came from the claimed project.
!
Instruction Scope
SKILL.md only documents CLI usage and a --process-signal integration, but the code persistently stores data under ~/.openclaw/workspace/.soul (mood-state.json, mood-patterns.json, mood-history.jsonl) and records conversation excerpts/context into history. It also publishes/reads signals via a file-based signals queue. Those storage and inter-process communication behaviors are not emphasized in SKILL.md and may have privacy/side-effect implications.
Install Mechanism
There is no install spec (instruction-only at registry level) but the package includes package.json and package-lock.json with normal npm deps (chalk, commander, date-fns). Dependencies are typical and fetched from npm. The missing bin/main files noted above mean 'npm install' or 'npm run' expectations may not match bundled files. No external download URLs or obfuscated installers were found.
!
Credentials
The skill requests no credentials, but it reads process.env.HOME and creates persistent files in the user's home workspace. Default config enables publishStateSignals/publishPatternSignals/publishEnergyAlerts = true, meaning the skill will, by default, emit signals (to other local skills/components) that may include state and excerpts. That degree of local persistence and cross-component signaling is legitimate for this feature but is a privacy risk and should be explicitly acknowledged before use.
!
Persistence & Privilege
always:false (good), but disable-model-invocation:false (usual). Combined with autonomous invocation and default signal-publishing, the skill can autonomously write persistent state and post signals to the shared .soul/signals queue. This gives it a persistent presence (local files, history log) and an inter-skill communication channel — expected for an integration but potentially surprising and broad in scope.
What to consider before installing
This package largely implements a plausible mood/energy classifier, but check the following before installing or enabling it for autonomous use: 1) Packaging mismatches: package.json references scripts (scripts/mood.js, bin/soul_mood.js) that are not present and version numbers differ — verify the source repository and that the bundle is complete. 2) Persistent storage: it will create ~/.openclaw/workspace/.soul and write mood-state, mood-patterns, and mood-history.jsonl (which can include conversation excerpts). If you care about privacy, review those files and set config saveRawAssessments/publish* flags to false or restrict the directory. 3) Signal publishing: by default it will publish signals to a file-based queue (signals/pending.jsonl) which other local skills may read; consider disabling publishStateSignals/publishPatternSignals/publishEnergyAlerts unless you trust the local skill ecosystem. 4) Run tests in a sandbox: run npm install and npm test in an isolated environment (or inspect the code) before giving it broader privileges or enabling autonomous invocation. 5) If you want to proceed, consider editing the config (mood-config.json) to disable automatic publishing and to opt out of saving raw assessments, and verify the lack of network calls and secrets. If the missing files or version mismatch cannot be resolved, avoid installing until you obtain a complete, signed release from a trusted source.

Like a lobster shell, security has layers — review code before you run it.

latestvk975bv7vfz3hfcbqdqxgwbnahn8425bc
96downloads
0stars
4versions
Updated 3w ago
v0.4.0
MIT-0

Mood Simulator - 情绪状态模拟器

使用方法

直接调用

node scripts/simulator.js <命令> [选项]

信号处理模式

node scripts/simulator.js --process-signal <signal>

命令

  • simulate [选项] - 模拟情绪状态
  • adjust [选项] - 调整情绪参数
  • track - 追踪情绪变化

示例

# 模拟情绪
node scripts/simulator.js simulate --energy 70 --focus 80

# 调整时间因子
node scripts/simulator.js adjust --time-factor morning

# 信号处理
node scripts/simulator.js --process-signal transition

与proactive-engine集成

该skill通过--process-signal参数与proactive-engine信号系统集成,支持实时情绪追踪和能量警报。

Comments

Loading comments...