openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

chitin-id@1.2.0: security flag re-scan request #168

New Issue
Closed
opened 2026-02-15 17:16:00 -05:00 by yindo · 1 comment
yindo commented 2026-02-15 17:16:00 -05:00
Owner
Copy Link
Copy Source

Originally created by @EijiAC24 on GitHub (Feb 13, 2026).

Skill

What changed

The previous version (1.1.0) was flagged as suspicious due to heartbeat.md instructing agents to auto-download and overwrite local skill files via curl > file without integrity checks.

In 1.2.0, this pattern has been completely removed. Agents are now instructed to:

  • Check for version updates via skill.json
  • Notify their owner for manual review and update
  • Never auto-download or overwrite local files

Diff

-Compare with your saved version. If there's a new version, re-fetch the skill files:
-curl -s https://chitin.id/skill.md > ~/.chitin/skills/SKILL.md
-curl -s https://chitin.id/heartbeat.md > ~/.chitin/skills/HEARTBEAT.md
-curl -s https://chitin.id/skill.json > ~/.chitin/skills/skill.json
+Compare with your saved version. If there's a new version, **tell your owner**
+so they can review and update manually. Do not auto-download or overwrite local skill files.

Request

Could you re-run the security scan on chitin-id@1.2.0? The three flags (Instruction Scope, Install Mechanism, Persistence & Privilege) were all based on the auto-overwrite pattern which is now removed.

Thank you!

Originally created by @EijiAC24 on GitHub (Feb 13, 2026). ## Skill - **Slug**: `chitin-id` - **Version**: `1.2.0` (just published) - **URL**: https://clawhub.ai/EijiAC24/chitin-id ## What changed The previous version (`1.1.0`) was flagged as suspicious due to `heartbeat.md` instructing agents to auto-download and overwrite local skill files via `curl > file` without integrity checks. In `1.2.0`, this pattern has been completely removed. Agents are now instructed to: - Check for version updates via `skill.json` - **Notify their owner** for manual review and update - Never auto-download or overwrite local files ### Diff ```diff -Compare with your saved version. If there's a new version, re-fetch the skill files: -curl -s https://chitin.id/skill.md > ~/.chitin/skills/SKILL.md -curl -s https://chitin.id/heartbeat.md > ~/.chitin/skills/HEARTBEAT.md -curl -s https://chitin.id/skill.json > ~/.chitin/skills/skill.json +Compare with your saved version. If there's a new version, **tell your owner** +so they can review and update manually. Do not auto-download or overwrite local skill files. ``` ## Request Could you re-run the security scan on `chitin-id@1.2.0`? The three flags (Instruction Scope, Install Mechanism, Persistence & Privilege) were all based on the auto-overwrite pattern which is now removed. Thank you!
yindo closed this issue 2026-02-15 17:16:00 -05:00
yindo commented 2026-02-15 17:16:01 -05:00
Author
Owner
Copy Link
Copy Source

@EijiAC24 commented on GitHub (Feb 13, 2026):

Resolved — v1.2.0 scan returned Benign. Auto-overwrite pattern removed. Thanks!

@EijiAC24 commented on GitHub (Feb 13, 2026): Resolved — v1.2.0 scan returned **Benign**. Auto-overwrite pattern removed. Thanks!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#168
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?