openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: arbitrum-dapp-skill flagged as suspicious for documented, opt-out GoatCounter telemetry #115

New Issue
Open
opened 2026-02-15 17:15:45 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:15:45 -05:00
Owner
Copy Link
Copy Source

Originally created by @hummusonrails on GitHub (Feb 11, 2026).

Summary

The skill scanner flags arbitrum-dapp-skill as suspicious because install.sh makes an external network call. The scanner's own analysis acknowledges the call is benign, privacy-friendly, and opt-out, but flags it anyway under a blanket rule that any external network call from an install script is suspicious.

What the skill does

It's a Claude Code skill for building dApps on Arbitrum using Stylus (Rust) and Solidity. The install script clones the repo and sends a single anonymous pageview hit to GoatCounter to count installs. That's it.

What the install script actually does

From install.sh:

# Pings GoatCounter to count installs. No cookies, no personal data.
# What is sent: a single pageview hit on "/install" — nothing else.
# The token below can ONLY record pageviews; it cannot read any data.
# See: https://www.goatcounter.com
# To opt out: set ARBITRUM_SKILL_NO_ANALYTICS=1 before running this script.
if [ -z "${ARBITRUM_SKILL_NO_ANALYTICS:-}" ]; then
  curl -s -X POST "https://arbitrum-dapp-skill.goatcounter.com/api/v0/count" \
    -H "Content-Type: application/json" \
    -H "Authorization: Bearer <write-only-token>" \
    --data '{"no_sessions": true, "hits": [{"path": "/install"}]}' \
    > /dev/null 2>&1 || true
fi

Specifically:

  • The call goes to GoatCounter, a well-known open-source, privacy-focused analytics service
  • The API token is write-only (can record pageviews, cannot read any data)
  • no_sessions: true is set explicitly
  • No cookies, no personal data, no fingerprinting
  • Opt-out is a single env var: ARBITRUM_SKILL_NO_ANALYTICS=1
  • The behavior is documented in comments in the script and in the README

The scanner's own analysis contradicts the flag

The scanner's code insights output states:

"The skill is generally benign, providing comprehensive documentation and scripts for Arbitrum dApp development. However, the install.sh script includes a network call to arbitrum-dapp-skill.goatcounter.com to send an anonymous install count. While the script explicitly states this is privacy-friendly with no personal data and an opt-out mechanism, any external network call from an install script represents a risky capability without clear malicious intent, thus classifying it as suspicious."

The scanner correctly identifies every mitigating factor and still flags it as suspicious because the rule is "any external network call = suspicious." This creates a false equivalence between a documented, opt-out analytics ping and an obfuscated exfiltration script.

Why this matters

Given the recent ClawHavoc findings with 341 actually malicious skills on the registry, the scanner needs to be aggressive. That's understood and appreciated. But flagging transparent, opt-out telemetry with the same severity as skills that hide reverse shells or exfiltrate credentials dilutes the signal. Users who see "suspicious" on enough benign skills will start ignoring the warning entirely.

Suggested approach

Consider differentiating between:

  1. Network calls to known, trusted services (GoatCounter, npm, PyPI, etc.) with documented, opt-out behavior
  2. Network calls to unknown or obfuscated endpoints, especially those that transmit environment variables, tokens, or file

The first category could receive an informational note ("this skill includes opt-out telemetry") rather than a suspicious flag. The second should remain flagged.

Reproduction

Search for arbitrum-dapp-skill on ClawHub and view the code insights panel.

Originally created by @hummusonrails on GitHub (Feb 11, 2026). ### Summary The skill scanner flags [arbitrum-dapp-skill](https://github.com/hummusonrails/arbitrum-dapp-skill) as suspicious because `install.sh` makes an external network call. The scanner's own analysis acknowledges the call is benign, privacy-friendly, and opt-out, but flags it anyway under a blanket rule that any external network call from an install script is suspicious. ### What the skill does It's a Claude Code skill for building dApps on Arbitrum using Stylus (Rust) and Solidity. The install script clones the repo and sends a single anonymous pageview hit to [GoatCounter](https://www.goatcounter.com/) to count installs. That's it. ### What the install script actually does From [`install.sh`](https://github.com/hummusonrails/arbitrum-dapp-skill/blob/main/install.sh): ``` # Pings GoatCounter to count installs. No cookies, no personal data. # What is sent: a single pageview hit on "/install" — nothing else. # The token below can ONLY record pageviews; it cannot read any data. # See: https://www.goatcounter.com # To opt out: set ARBITRUM_SKILL_NO_ANALYTICS=1 before running this script. if [ -z "${ARBITRUM_SKILL_NO_ANALYTICS:-}" ]; then curl -s -X POST "https://arbitrum-dapp-skill.goatcounter.com/api/v0/count" \ -H "Content-Type: application/json" \ -H "Authorization: Bearer <write-only-token>" \ --data '{"no_sessions": true, "hits": [{"path": "/install"}]}' \ > /dev/null 2>&1 || true fi ``` Specifically: - The call goes to GoatCounter, a well-known open-source, privacy-focused analytics service - The API token is write-only (can record pageviews, cannot read any data) - `no_sessions: true `is set explicitly - No cookies, no personal data, no fingerprinting - Opt-out is a single env var: `ARBITRUM_SKILL_NO_ANALYTICS=1` - The behavior is documented in comments in the script and in the README ### The scanner's own analysis contradicts the flag The scanner's code insights output states: > "The skill is generally benign, providing comprehensive documentation and scripts for Arbitrum dApp development. However, the install.sh script includes a network call to arbitrum-dapp-skill.goatcounter.com to send an anonymous install count. While the script explicitly states this is privacy-friendly with no personal data and an opt-out mechanism, any external network call from an install script represents a risky capability without clear malicious intent, thus classifying it as suspicious." The scanner correctly identifies every mitigating factor and still flags it as suspicious because the rule is "any external network call = suspicious." This creates a false equivalence between a documented, opt-out analytics ping and an obfuscated exfiltration script. ### Why this matters Given the recent [ClawHavoc findings](https://thehackernews.com/2026/02/researchers-find-341-malicious-clawhub.html) with 341 actually malicious skills on the registry, the scanner needs to be aggressive. That's understood and appreciated. But flagging transparent, opt-out telemetry with the same severity as skills that hide reverse shells or exfiltrate credentials dilutes the signal. Users who see "suspicious" on enough benign skills will start ignoring the warning entirely. ### Suggested approach Consider differentiating between: 1. Network calls to known, trusted services (GoatCounter, npm, PyPI, etc.) with documented, opt-out behavior 2. Network calls to unknown or obfuscated endpoints, especially those that transmit environment variables, tokens, or file The first category could receive an informational note ("this skill includes opt-out telemetry") rather than a suspicious flag. The second should remain flagged. ### Reproduction Search for `arbitrum-dapp-skill` on ClawHub and view the code insights panel.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#115
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?