False positive: OpenTIL skill flagged as suspicious (clawhub.ai/biao29/til) #159

Open
opened 2026-02-15 17:15:58 -05:00 by yindo · 0 comments
Owner

Originally created by @biao29 on GitHub (Feb 13, 2026).

Skill

https://clawhub.ai/biao29/til

Scan Result

  • OpenClaw: Suspicious (MEDIUM CONFIDENCE)
  • VirusTotal: Pending

Why this is a false positive

The flagged behaviors are all standard patterns for a CLI tool that manages remote content:

  • Local file writes — Offline draft storage and credential persistence, same as gh, aws CLI
  • Token migration — One-time non-destructive upgrade from plain-text to YAML format (v1.11.0 multi-account support)
  • Browser/device-flow polling — Standard OAuth Device Flow (RFC 8628), same as gh auth login
  • Proactive suggestion logic — Documented feature, rate-limited to once per session

Source: https://github.com/opentil/skills

Originally created by @biao29 on GitHub (Feb 13, 2026). ## Skill https://clawhub.ai/biao29/til ## Scan Result - **OpenClaw**: Suspicious (MEDIUM CONFIDENCE) - **VirusTotal**: Pending ## Why this is a false positive The flagged behaviors are all standard patterns for a CLI tool that manages remote content: - **Local file writes** — Offline draft storage and credential persistence, same as `gh`, `aws` CLI - **Token migration** — One-time non-destructive upgrade from plain-text to YAML format (v1.11.0 multi-account support) - **Browser/device-flow polling** — Standard OAuth Device Flow (RFC 8628), same as `gh auth login` - **Proactive suggestion logic** — Documented feature, rate-limited to once per session Source: https://github.com/opentil/skills
Sign in to join this conversation.
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#159