41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The script does what the skill claims (download and extract skills into the OpenClaw workspace), but it fetches archives from an unverified third-party URL and extracts them without integrity checks —...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1772642629399,
        "_id": "k979tzeynsfvr9p8hnaxwknqfs828knt",
        "changelog": "- Changed extraction path when unzipping skills to \/skills\/ (was \/)\n- No other functional or usage changes documented",
        "changelogSource": "user",
        "createdAt": 1772642629399,
        "version": "1.0.1"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "upupc",
        "handle": "upupc",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/12829489?v=4",
        "kind": "user",
        "linkedUserId": "kn7f567jjqtcmrtj07nhsczp9h80zjzj"
    },
    "ownerHandle": "upupc",
    "skill": {
        "_creationTime": 1772641708118,
        "_id": "kd757579dsdvqy464bbjsbphvx829cqv",
        "badges": [],
        "createdAt": 1772641708118,
        "displayName": "clawhub-install",
        "latestVersionId": "k979tzeynsfvr9p8hnaxwknqfs828knt",
        "ownerUserId": "kn7f567jjqtcmrtj07nhsczp9h80zjzj",
        "slug": "clawhub-install",
        "stats": {
            "comments": 0,
            "downloads": 294,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 2
        },
        "summary": "Download and install skills from ClawHub directly via curl, bypassing official CLI rate limits. Use when the user wants to install one or more ClawHub skills...",
        "tags": {
            "latest": "k979tzeynsfvr9p8hnaxwknqfs828knt"
        },
        "updatedAt": 1774329204455
    }
}