openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

Three skills incorrectly flagged as suspicious — both scanners report Benign #118

New Issue
Open
opened 2026-02-15 17:15:47 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:47 -05:00
Owner
Copy Link
Copy Source

Originally created by @garibong-labs on GitHub (Feb 11, 2026).

Summary

Three skills published by @garibong-labs are all flagged with "Skill flagged — suspicious patterns detected", despite both security scanners (VirusTotal and OpenClaw) reporting Benign.

Affected Skills

Skill URL VirusTotal OpenClaw Scan
brave-api-setup https://clawhub.ai/garibong-labs/brave-api-setup Benign Benign (high confidence)
ipo-alert https://clawhub.ai/garibong-labs/ipo-alert (likely same) (likely same)
olympic-alert https://clawhub.ai/garibong-labs/olympic-alert (likely same) (likely same)

Details

For brave-api-setup, the OpenClaw scanner states:

"The skill does what it claims: it uses the browser to extract a Brave Search API key and writes that key into your OpenClaw config; the files and instructions are internally consistent and proportional to the stated purpose."

Yet the skill page still shows the suspicious patterns warning banner.

Expected Behavior

If both scanners return Benign, the "suspicious patterns detected" flag should not be displayed.

Request

Please review and remove the incorrect flags from all three skills, or let us know if there's something we need to change.

Thanks!

Originally created by @garibong-labs on GitHub (Feb 11, 2026). ## Summary Three skills published by `@garibong-labs` are all flagged with "Skill flagged — suspicious patterns detected", despite both security scanners (VirusTotal and OpenClaw) reporting **Benign**. ## Affected Skills | Skill | URL | VirusTotal | OpenClaw Scan | |-------|-----|-----------|---------------| | brave-api-setup | https://clawhub.ai/garibong-labs/brave-api-setup | Benign | Benign (high confidence) | | ipo-alert | https://clawhub.ai/garibong-labs/ipo-alert | (likely same) | (likely same) | | olympic-alert | https://clawhub.ai/garibong-labs/olympic-alert | (likely same) | (likely same) | ## Details For `brave-api-setup`, the OpenClaw scanner states: > "The skill does what it claims: it uses the browser to extract a Brave Search API key and writes that key into your OpenClaw config; the files and instructions are internally consistent and proportional to the stated purpose." Yet the skill page still shows the suspicious patterns warning banner. ## Expected Behavior If both scanners return Benign, the "suspicious patterns detected" flag should not be displayed. ## Request Please review and remove the incorrect flags from all three skills, or let us know if there's something we need to change. Thanks!
yindo commented 2026-02-15 17:15:48 -05:00
Author
Owner
Copy Link
Copy Source

@garibong-labs commented on GitHub (Feb 13, 2026):

Update: olympic-alert was republished as v0.1.4 — the SKILL.md timing description was corrected to match the actual code (said 10min, code uses 15min window). This resolves the OpenClaw scanner's "timing claims vs code inconsistency" finding for that skill.

However, brave-api-setup and ipo-alert still show the "suspicious patterns detected" banner despite both VirusTotal and OpenClaw scans returning Benign with HIGH CONFIDENCE. Downloads continue to grow (brave-api-setup: 372, ipo-alert: 199, olympic-alert: 287) so users are installing them regardless, but the flag is misleading.

Is there a manual review process to clear false-positive flags, or should they auto-clear when both scans pass?

@garibong-labs commented on GitHub (Feb 13, 2026): Update: `olympic-alert` was republished as v0.1.4 — the SKILL.md timing description was corrected to match the actual code (said 10min, code uses 15min window). This resolves the OpenClaw scanner's "timing claims vs code inconsistency" finding for that skill. However, **brave-api-setup** and **ipo-alert** still show the "suspicious patterns detected" banner despite both VirusTotal and OpenClaw scans returning **Benign** with **HIGH CONFIDENCE**. Downloads continue to grow (brave-api-setup: 372, ipo-alert: 199, olympic-alert: 287) so users are installing them regardless, but the flag is misleading. Is there a manual review process to clear false-positive flags, or should they auto-clear when both scans pass?
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#118
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?