41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill claims to provide a human-in-the-loop shell interceptor but includes no implementation and tells you to run npm install against an odd package.json — this mismatch and the instruction to fet...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1770211907063,
        "_id": "k97f61gsrp1460022a9jzyc0z980g98r",
        "changelog": "Initial release of ClawShell: Human-in-the-loop security layer for shell command execution.\n\n- Intercepts shell commands, analyzes risk, and enforces push notification approval for high-risk operations.\n- Categorizes commands into Critical (blocked), High (approval required), Medium (logged), and Low (allowed).\n- Provides three main tools: `clawshell_bash` (secure command exec), `clawshell_status` (view pending\/recent approvals), and `clawshell_logs` (audit logs).\n- Supports push notifications via Pushover or Telegram.\n- Highly configurable through environment variables and `config.yaml`.\n- Enforces all decisions via a persistent JSONL audit log.",
        "changelogSource": "auto",
        "createdAt": 1770211907063,
        "parsed": {
            "clawdis": {
                "primaryEnv": "CLAWSHELL_PUSHOVER_USER",
                "requires": {
                    "bins": [
                        "node"
                    ],
                    "env": [
                        "CLAWSHELL_PUSHOVER_USER",
                        "CLAWSHELL_PUSHOVER_TOKEN"
                    ]
                }
            }
        },
        "version": "1.0.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "Lucky-2968",
        "handle": "lucky-2968",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/208146076?v=4",
        "kind": "user",
        "linkedUserId": "kn70yfxd3gt7f4qkzme5r98g1s80eg95"
    },
    "ownerHandle": "lucky-2968",
    "skill": {
        "_creationTime": 1770211907063,
        "_id": "kd7fysab00dzyqffgypefktkc980hx66",
        "badges": [],
        "createdAt": 1770211907063,
        "displayName": "Clawshell 0.1.0",
        "latestVersionId": "k97f61gsrp1460022a9jzyc0z980g98r",
        "ownerUserId": "kn70yfxd3gt7f4qkzme5r98g1s80eg95",
        "slug": "clawshell-0-1-0",
        "stats": {
            "comments": 0,
            "downloads": 1431,
            "installsAllTime": 2,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 1
        },
        "summary": "Human-in-the-loop security layer. Intercepts high-risk commands and requires push notification approval.",
        "tags": {
            "latest": "k97f61gsrp1460022a9jzyc0z980g98r"
        },
        "updatedAt": 1774322568523
    }
}