openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

RepoMedic skill flagged as suspicious despite benign scans (requesting review + guidance) #125

New Issue
Closed
opened 2026-02-15 17:15:49 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:15:49 -05:00
Owner
Copy Link
Copy Source

Originally created by @mrummler17 on GitHub (Feb 11, 2026).

Hi team,

Our ClawHub skill repomedic is currently flagged with “suspicious patterns detected”, but both scanner outputs show benign results:

OpenClaw scan: Benign (high confidence)
VirusTotal: Benign

This skill is a repo-maintenance tool (Dependabot triage, lockfile repair, scoped dependency PRs). It requires GitHub + filesystem access because those are necessary for the intended functionality.

We believe this may be a heuristic false-positive caused by privileged-but-expected repo automation patterns.

To improve clarity on our side, we are publishing an update that adds:

explicit listing summary
required binaries metadata (git, gh, pnpm)
explicit guardrails (no credential exfiltration, no unrelated service access, no destructive actions without explicit user direction)

Could you please review the flag status and advise what additional metadata/signals would help avoid this false-positive classification for legitimate maintenance skills?

Thanks Marcus

Originally created by @mrummler17 on GitHub (Feb 11, 2026). Hi team, Our ClawHub skill repomedic is currently flagged with “suspicious patterns detected”, but both scanner outputs show benign results: OpenClaw scan: Benign (high confidence) VirusTotal: Benign This skill is a repo-maintenance tool (Dependabot triage, lockfile repair, scoped dependency PRs). It requires GitHub + filesystem access because those are necessary for the intended functionality. We believe this may be a heuristic false-positive caused by privileged-but-expected repo automation patterns. To improve clarity on our side, we are publishing an update that adds: explicit listing summary required binaries metadata (git, gh, pnpm) explicit guardrails (no credential exfiltration, no unrelated service access, no destructive actions without explicit user direction) Could you please review the flag status and advise what additional metadata/signals would help avoid this false-positive classification for legitimate maintenance skills? Thanks Marcus
yindo closed this issue 2026-02-15 17:15:49 -05:00
yindo commented 2026-02-15 17:15:50 -05:00
Author
Owner
Copy Link
Copy Source

@mrummler17 commented on GitHub (Feb 13, 2026):

I've updated RepoMedic and this appears to have resolved the issues flagged.

@mrummler17 commented on GitHub (Feb 13, 2026): I've updated RepoMedic and this appears to have resolved the issues flagged.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#125
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?