openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-22 03:35:29 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: wp-multi-tool (WordPress optimization plugin) #193

New Issue
Open
opened 2026-02-15 17:16:08 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:08 -05:00
Owner
Copy Link
Copy Source

Originally created by @MarcinDudekDev on GitHub (Feb 15, 2026).

Hi ClawHub team,

My skill wp-multi-tool has been flagged as suspicious, and I believe this is a false positive.

Skill URL: https://clawhub.ai/MarcinDudekDev/wp-multi-tool
Skill slug: wp-multi-tool
Current version: 1.1.14
Author: @MarcinDudekDev / marcindudek.dev

Scan Results

  • VirusTotal: Suspicious
  • OpenClaw: Suspicious (MEDIUM CONFIDENCE) — "encourages installing a third-party plugin from an unknown site and contains instructions that can lead to site-modifying operations and potential data exposure"

What the Skill Is

WP Multi Tool is a WordPress optimization plugin with 13 modules (database cleanup, autoload tuning, slow query detection, frontend optimization, etc.). The skill teaches AI agents how to use WP-CLI commands to diagnose and optimize WordPress sites.

Why This Is a False Positive

  1. "Installing a third-party plugin from an unknown site" — The skill recommends installing the plugin from its official website (wpmultitool.com), which is the author's own product page. This is no different than any other skill that recommends installing its associated tool. The source code is available on GitHub.

  2. "Site-modifying operations" — The skill documents standard WP-CLI commands (wp transient delete --expired, wp db optimize, wp config set WP_POST_REVISIONS). These are native WordPress CLI operations that any WordPress administrator would run. The skill explicitly notes these are read-only diagnostics or standard maintenance commands.

  3. "Potential data exposure" — The skill explicitly states in its Security Note section: "No wp eval is used anywhere in this skill. No credentials, API keys, or sensitive config values are read or transmitted." All SQL queries are read-only SELECTs for diagnostic purposes.

  4. All WP-CLI commands used are well-documented, official WordPress commands. The plugin's own wp multitool subcommands are structured, validated, and registered through WordPress's standard command registration API.

Request

Could you please review and remove the suspicious flag? Happy to adjust any wording if specific patterns are triggering the scanner.

Thank you!
Marcin Dudek

Originally created by @MarcinDudekDev on GitHub (Feb 15, 2026). Hi ClawHub team, My skill **wp-multi-tool** has been flagged as suspicious, and I believe this is a false positive. **Skill URL:** https://clawhub.ai/MarcinDudekDev/wp-multi-tool **Skill slug:** `wp-multi-tool` **Current version:** 1.1.14 **Author:** [@MarcinDudekDev](https://github.com/MarcinDudekDev) / [marcindudek.dev](https://marcindudek.dev) ## Scan Results - **VirusTotal:** Suspicious - **OpenClaw:** Suspicious (MEDIUM CONFIDENCE) — *"encourages installing a third-party plugin from an unknown site and contains instructions that can lead to site-modifying operations and potential data exposure"* ## What the Skill Is WP Multi Tool is a **WordPress optimization plugin** with 13 modules (database cleanup, autoload tuning, slow query detection, frontend optimization, etc.). The skill teaches AI agents how to use WP-CLI commands to diagnose and optimize WordPress sites. - **Website:** https://wpmultitool.com - **Source code:** https://github.com/MarcinDudekDev/wp-wp-multitool - **Plugin is public and open source** ## Why This Is a False Positive 1. **"Installing a third-party plugin from an unknown site"** — The skill recommends installing the plugin from its official website (wpmultitool.com), which is the author's own product page. This is no different than any other skill that recommends installing its associated tool. The source code is available on GitHub. 2. **"Site-modifying operations"** — The skill documents standard WP-CLI commands (`wp transient delete --expired`, `wp db optimize`, `wp config set WP_POST_REVISIONS`). These are **native WordPress CLI operations** that any WordPress administrator would run. The skill explicitly notes these are read-only diagnostics or standard maintenance commands. 3. **"Potential data exposure"** — The skill explicitly states in its Security Note section: *"No `wp eval` is used anywhere in this skill. No credentials, API keys, or sensitive config values are read or transmitted."* All SQL queries are read-only SELECTs for diagnostic purposes. 4. **All WP-CLI commands used are well-documented, official WordPress commands.** The plugin's own `wp multitool` subcommands are structured, validated, and registered through WordPress's standard command registration API. ## Request Could you please review and remove the suspicious flag? Happy to adjust any wording if specific patterns are triggering the scanner. Thank you! Marcin Dudek
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#193
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?