openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

pipelock skill flagged as suspicious — OpenClaw medium-confidence, addressing transparency gaps #124

New Issue
Closed
opened 2026-02-15 17:15:49 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:49 -05:00
Owner
Copy Link
Copy Source

Originally created by @luckyPipewrench on GitHub (Feb 11, 2026).

The pipelock skill (clawhub.ai/luckyPipewrench/pipelock) is flagged "suspicious patterns detected" with OpenClaw at medium confidence. VirusTotal reports benign.

Pipelock is a security proxy for AI agents. It sits between the agent and the internet, scanning outbound HTTP for credential leaks, SSRF, and prompt injection. Apache 2.0, open source at github.com/luckyPipewrench/pipelock.

Addressing the findings:

OpenClaw flagged several transparency gaps. I'm publishing an updated SKILL.md that addresses them:

  1. Credentials / Instruction Scope: Added a "Data Access" section explicitly stating that pipelock reads process environment variables (for leak detection fingerprinting), inspects HTTP bodies in-flight (as a proxy), and reads workspace files (integrity hashing only). No data is stored or transmitted externally.

  2. Purpose & Capability mismatch: The install commands (brew, go install) are one-time install methods, not runtime dependencies. I've clarified this in the updated SKILL.md. The npx in the MCP example is the user's MCP server being wrapped, not a pipelock dependency. I've added a note clarifying this.

  3. No telemetry: Added explicit statement that pipelock has no network callbacks, analytics, or telemetry.

Possible heuristic improvement:

OpenClaw treats install instructions in code blocks (brew, go install) as undeclared runtime dependencies. These are clearly labeled under an "Installation" heading and are not invoked at runtime. It might help to distinguish install-section code blocks from runtime usage when scoring.

Happy to make further SKILL.md changes if there are other signals that would help the classifier.

Originally created by @luckyPipewrench on GitHub (Feb 11, 2026). The pipelock skill ([clawhub.ai/luckyPipewrench/pipelock](https://clawhub.ai/luckyPipewrench/pipelock)) is flagged "suspicious patterns detected" with OpenClaw at medium confidence. VirusTotal reports benign. Pipelock is a security proxy for AI agents. It sits between the agent and the internet, scanning outbound HTTP for credential leaks, SSRF, and prompt injection. Apache 2.0, open source at [github.com/luckyPipewrench/pipelock](https://github.com/luckyPipewrench/pipelock). **Addressing the findings:** OpenClaw flagged several transparency gaps. I'm publishing an updated SKILL.md that addresses them: 1. **Credentials / Instruction Scope**: Added a "Data Access" section explicitly stating that pipelock reads process environment variables (for leak detection fingerprinting), inspects HTTP bodies in-flight (as a proxy), and reads workspace files (integrity hashing only). No data is stored or transmitted externally. 2. **Purpose & Capability mismatch**: The install commands (`brew`, `go install`) are one-time install methods, not runtime dependencies. I've clarified this in the updated SKILL.md. The `npx` in the MCP example is the user's MCP server being wrapped, not a pipelock dependency. I've added a note clarifying this. 3. **No telemetry**: Added explicit statement that pipelock has no network callbacks, analytics, or telemetry. **Possible heuristic improvement:** OpenClaw treats install instructions in code blocks (brew, go install) as undeclared runtime dependencies. These are clearly labeled under an "Installation" heading and are not invoked at runtime. It might help to distinguish install-section code blocks from runtime usage when scoring. Happy to make further SKILL.md changes if there are other signals that would help the classifier.
yindo closed this issue 2026-02-15 17:15:49 -05:00
yindo commented 2026-02-15 17:15:49 -05:00
Author
Owner
Copy Link
Copy Source

@luckyPipewrench commented on GitHub (Feb 11, 2026):

Pulling the listing. Pipelock is infrastructure, not really a skill. Thanks for the scanner feedback though.

@luckyPipewrench commented on GitHub (Feb 11, 2026): Pulling the listing. Pipelock is infrastructure, not really a skill. Thanks for the scanner feedback though.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#124
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?