37/100 (High)

OpenClaw： suspicious
VirusTotal： suspicious
StaticScan： suspicious

OpenClaw： suspicious

The skill is largely consistent with a license-scanning CLI (npm package + git hooks), but there are implementation mismatches, misleading claims in the docs, and a couple of design choices that deser...

[内容已截断]

VirusTotal： suspicious VT 报告

静态扫描： suspicious

Detected: suspicious.dangerous_exec, suspicious.potential_exfiltration

README 未提供

{
    "latestVersion": {
        "_creationTime": 1774828661925,
        "_id": "k973cyk58habke3ftj4erjyf9983vbpa",
        "changelog": "# Release Notes: wip-ai-devops-toolbox v1.9.65\n\n**Fix release notes scaffold on protected branches**\n\nWhen `wip-release patch` runs on main without a RELEASE-NOTES file, it used to scaffold a\ntemplate directly in the working tree. On repos with branch guards (pre-commit hooks that\nblock commits to main), this scaffolded file could not be removed or committed. It would\nblock `git pull` and leave the working tree dirty. This has happened multiple times across\ndifferent repos.\n\nThe fix adds a branch check before scaffolding. If the current branch is main or master,\nwip-release now prints a clear error telling the user to write release notes on their\nfeature branch before merging, then exits non-zero without creating any files. The scaffold\nbehavior still works on feature branches, where it's actually useful.\n\n## Issues closed\n\n- Closes #223\n\n## How to verify\n\n```bash\n# On main, without release notes: should error, NOT scaffold\ncd any-repo && git checkout main\nwip-release patch\n# Expected: \"Release notes missing. Write RELEASE-NOTES-v*.md on your feature branch before merging.\"\n# Expected: no RELEASE-NOTES file created in working tree\n\n# On a feature branch: should scaffold as before\ngit checkout -b test\/scaffold-check\nwip-release patch\n# Expected: scaffolded template created\n```",
        "changelogSource": "user",
        "createdAt": 1774828661925,
        "parsed": {
            "clawdis": {
                "emoji": "🛡️",
                "install": [
                    {
                        "bins": [
                            "wip-license-hook"
                        ],
                        "id": "node",
                        "kind": "node",
                        "label": "Install via npm",
                        "package": "@wipcomputer\/wip-license-hook"
                    }
                ],
                "requires": {
                    "bins": [
                        "node",
                        "git",
                        "npm"
                    ]
                }
            }
        },
        "version": "1.9.65"
    },
    "owner": {
        "_creationTime": 0,
        "_id": "s17620xzyc7kfan8m36at57m6n83h8he",
        "displayName": "Parker Todd Brooks",
        "handle": "parkertoddbrooks",
        "image": "https:\/\/avatars.githubusercontent.com\/u\/585456?v=4",
        "kind": "user",
        "linkedUserId": "kn7b4mj57xb02gqhvjzgzkxq557zz95h"
    },
    "ownerHandle": "parkertoddbrooks",
    "skill": {
        "_creationTime": 1773281849864,
        "_id": "kd736tbsc39qhd27v3qtcn8zfd82rz0b",
        "badges": [],
        "createdAt": 1773281849864,
        "displayName": "Wip License Hook",
        "latestVersionId": "k973cyk58habke3ftj4erjyf9983vbpa",
        "ownerPublisherId": "s17620xzyc7kfan8m36at57m6n83h8he",
        "ownerUserId": "kn7b4mj57xb02gqhvjzgzkxq557zz95h",
        "slug": "wip-license-hook",
        "stats": {
            "comments": 0,
            "downloads": 528,
            "installsAllTime": 0,
            "installsCurrent": 0,
            "stars": 0,
            "versions": 62
        },
        "summary": "License rug-pull detection. Scans dependencies and forks for license changes, gates upstream merges, maintains a license ledger, and generates a public compl...",
        "tags": {
            "latest": "k973cyk58habke3ftj4erjyf9983vbpa"
        },
        "updatedAt": 1774832508507
    }
}