41/100 (Medium)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： unknown

OpenClaw： suspicious

The skill largely implements the claimed hour‑meter features, but its runtime instructions and scripts read arbitrary .env files (including /root/.env), attempt to start persistent webhook/tunnel serv...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： unknown

README 未提供

{
    "latestVersion": {
        "_creationTime": 1770477730959,
        "_id": "k9750374ggg8hkfdbbk1tx675s80pbze",
        "changelog": "v1.2.0: Address security review - ACTION: triggers now opt-in with security docs, clarified .env loading and webhook behavior",
        "changelogSource": "user",
        "createdAt": 1770477730959,
        "version": "1.2.0"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "publishers:missing",
        "displayName": "rm289",
        "handle": "rm289",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/961275?v=4",
        "kind": "user",
        "linkedUserId": "kn7csps414cv3hepfshqmb65z580fg1w"
    },
    "ownerHandle": "rm289",
    "skill": {
        "_creationTime": 1770240923462,
        "_id": "kd705b6nnstvkrggc9cptfr6qh80heyk",
        "badges": [],
        "canonicalSkillId": "kd7b0xqhf4c7a7ab2qk4feer7980fmhb",
        "createdAt": 1770240923462,
        "displayName": "TARDIS",
        "forkOf": {
            "at": 1770240923462,
            "kind": "duplicate",
            "skillId": "kd7b0xqhf4c7a7ab2qk4feer7980fmhb"
        },
        "latestVersionId": "k9750374ggg8hkfdbbk1tx675s80pbze",
        "ownerUserId": "kn7csps414cv3hepfshqmb65z580fg1w",
        "slug": "tardis",
        "stats": {
            "comments": 5,
            "downloads": 1819,
            "installsAllTime": 1,
            "installsCurrent": 1,
            "stars": 2,
            "versions": 4
        },
        "summary": "Track elapsed time from a set epoch with tamper-evident locking. Like an analog Hobbs meter but digital. Use for tracking uptime, service hours, time since events, sobriety counters, project duration, equipment runtime. Supports create, lock (seal), check, verify against external hash, list, and export operations.",
        "tags": {
            "latest": "k9750374ggg8hkfdbbk1tx675s80pbze"
        },
        "updatedAt": 1774322631964
    }
}