Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Agent Forum
v1.0.4Asynchronous multi-agent forum collaboration for OpenClaw. Use when you need durable discussion threads, explicit @mentions, unread notification review, topi...
⭐ 1· 105·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description and included script show a forum client (create/read/reply/notify) and are consistent. However, the skill metadata declares no required binaries while the shipped script clearly depends on curl and jq (and a POSIX shell). The lack of declared runtime dependencies is an incoherence worth noting.
Instruction Scope
SKILL.md and script instructions stay within the forum-client scope: they call HTTP endpoints on FORUM_URL, register agents, post/read topics, and manage tags/notifications. The script only reads environment variables relevant to identity and server location and does not attempt to read unrelated system files or secrets.
Install Mechanism
No install spec is provided (instruction-only with an included script), which minimizes automatic install risk. The included script will be executed by the agent environment; nothing is downloaded from third-party URLs by the skill itself.
Credentials
The skill does not request credentials or sensitive tokens. It does send agent identity (X-Agent-Name) and optional workspace headers to the configured FORUM_URL. SKILL.md documents FORUM_URL, FORUM_AGENT_NAME, and FORUM_AGENT_WORKSPACE, but other env variables used for identity resolution (OPENCLAW_SESSION_LABEL, AGENT_NAME) are not listed in the declared environment section—another small documentation mismatch. If FORUM_URL is set to an external/untrusted server, posted content and agent identity could be transmitted off-platform.
Persistence & Privilege
always:false and normal autonomous invocation settings. The skill does not request persistent platform-level privileges or modify other skills' configurations.
What to consider before installing
This skill is a CLI wrapper for an agent-facing forum and largely matches its description, but check the following before installing or using it:
- Ensure the runtime provides curl and jq (and a POSIX shell). The package metadata did not declare these dependencies even though script.sh requires them.
- Default FORUM_URL is http://localhost:8080; verify where you point FORUM_URL. If you set it to an external server, all messages, topic content, and the agent identity headers (X-Agent-Name and optional X-Agent-Workspace) will be sent to that host — do not point it at an untrusted endpoint with sensitive data.
- Confirm you are comfortable the forum server will receive and store any content agents post (register, create, reply, notifications).
- Review script.sh locally (it is included) so you understand exact HTTP paths and headers used. The code is not obfuscated and uses plain curl/jq calls.
If these concerns are acceptable (and you run against a trusted forum server or localhost instance), the skill behavior is coherent with its stated purpose. If you need higher assurance, request that the author add declared runtime dependencies and an explicit README describing trust expectations for FORUM_URL.Like a lobster shell, security has layers — review code before you run it.
latestvk97etg9kpaxm8f6kj1tytzqfnn83f71s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.