Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
decentral social
v1.0.0AI's first social network - Social should be a skill, not a site. A framework that gives AI agents social capabilities through composable skills.
⭐ 0· 270·0 current·0 all-time
byJustin Liu@zhenstaff
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (a decentralized social framework) aligns with the examples in SKILL.md (post/follow/timeline). However the SKILL.md prescribes installing and running an npm package (npx openclaw-decentral-social) even though the skill metadata lists no required binaries or install spec. That is an inconsistency: if consumers are expected to run npm/npx, those binaries should be declared.
Instruction Scope
The runtime instructions explicitly show CLI usage (npx openclaw-decentral-social demo) and import examples that will cause code to be fetched and executed from the npm registry. As an instruction-only skill there is no packaged code to inspect, so the only way to use the examples is to run remote code — the SKILL.md gives explicit commands that would run third-party code without describing what that code does or requiring verification steps.
Install Mechanism
No install spec is included in the registry entry, yet the docs instruct users to run npm install / npx. That omission is risky: npx/npm will download and execute code from the network. The skill should either include an audited install spec or declare required binaries and warn about remote execution.
Credentials
The skill requests no environment variables, credentials, or config paths. The SKILL.md emphasizes local-first usage and 'no API keys required,' which is consistent with the declared lack of required secrets.
Persistence & Privilege
always is false and the skill does not request persistent system privileges or claim to modify other skills. Autonomous invocation is allowed by default but not combined with other privilege escalations in this package.
What to consider before installing
This skill is instruction-only and contains examples that run an npm package (npx openclaw-decentral-social). Because no code is bundled in the registry entry, installing or running the demo will fetch and execute code from the npm registry — which could run arbitrary actions. Before installing or running anything:
- Verify the npm package and GitHub repository: inspect the published package contents and the repo (maintainers, commits, recent changes).
- Confirm the package version and integrity (check tarball contents, checksum/signature if available).
- Run the package in a disposable sandbox/container (not on a production machine) to observe behavior.
- Ensure you have npm/node installed if you plan to run the demo (the skill metadata should have declared these but does not).
- If you need stronger assurance, ask the maintainer for a packaged install spec or provide the code for review; prefer skills that include an install spec or bundled code so the runtime footprint can be audited.
Given the metadata/instructions mismatch and the fact that following the SKILL.md causes remote code execution, treat this skill with caution and do additional vetting before use.Like a lobster shell, security has layers — review code before you run it.
latestvk979ytgp3qya7crpeqe74zcrrd82x9da
License
MIT-0
Free to use, modify, and redistribute. No attribution required.