openclaw/clawhub
1
0
Fork 0
mirror of https://github.com/openclaw/clawhub.git synced 2026-07-21 19:25:25 -04:00
Code Issues 183 Packages Projects Releases 1 Wiki Activity

False positive: 4 skills by @alirezarezvani incorrectly flagged as suspicious #200

New Issue
Open
opened 2026-02-15 17:16:11 -05:00 by yindo · 0 comments
yindo commented 2026-02-15 17:16:11 -05:00
Owner
Copy Link
Copy Source

Originally created by @alirezarezvani on GitHub (Feb 15, 2026).

Flagged Skills

The following 4 skills owned by @alirezarezvani are flagged as suspicious on ClawHub, but all have been manually audited and confirmed safe:

Skill VirusTotal OpenClaw Scan Actual Risk
qms-audit-expert Benign Benign (high confidence) None — pure stdlib Python (audit scheduler), no network, no secrets
senior-backend Suspicious Benign (high confidence) Load tester uses urllib (expected behavior). Scaffolder & migration tool are pure file generators. Reference docs contain example code with process.env.JWT_SECRET etc. — teaching examples, not executed.
senior-devops ? ? Pure code generators (Terraform scaffolder, pipeline generator, deployment manager). No network calls, no env access, no filesystem danger.
senior-architect ? ? Analysis tools (architecture diagram generator, dependency analyzer, project architect). Pure stdlib Python, no external calls.

Analysis

All scripts were audited with:

  • grep -rn for: urlopen, requests., subprocess, os.system, eval(, exec(, os.environ, getenv, shutil.rmtree, os.remove, chmod, pickle, marshal, __import__
  • Only hit: api_load_tester.py in senior-backend uses urllib — which is its entire purpose as a load testing tool.
  • Reference markdown files in senior-backend contain code examples mentioning JWT secrets and passwords — these are educational content, not executable code.

Request

Please unflag all 4 skills. The VirusTotal Code Insight scanner appears to be triggering on:

  1. Presence of Python scripts (regardless of content)
  2. Security-related terminology in reference documentation
  3. Network-related stdlib imports in tools explicitly designed for HTTP testing

Thank you!

Originally created by @alirezarezvani on GitHub (Feb 15, 2026). ## Flagged Skills The following 4 skills owned by `@alirezarezvani` are flagged as suspicious on ClawHub, but all have been manually audited and confirmed safe: | Skill | VirusTotal | OpenClaw Scan | Actual Risk | |-------|-----------|---------------|-------------| | [qms-audit-expert](https://clawhub.ai/alirezarezvani/qms-audit-expert) | **Benign** | **Benign** (high confidence) | None — pure stdlib Python (audit scheduler), no network, no secrets | | [senior-backend](https://clawhub.ai/alirezarezvani/senior-backend) | Suspicious | **Benign** (high confidence) | Load tester uses `urllib` (expected behavior). Scaffolder & migration tool are pure file generators. Reference docs contain example code with `process.env.JWT_SECRET` etc. — teaching examples, not executed. | | [senior-devops](https://clawhub.ai/alirezarezvani/senior-devops) | ? | ? | Pure code generators (Terraform scaffolder, pipeline generator, deployment manager). No network calls, no env access, no filesystem danger. | | [senior-architect](https://clawhub.ai/alirezarezvani/senior-architect) | ? | ? | Analysis tools (architecture diagram generator, dependency analyzer, project architect). Pure stdlib Python, no external calls. | ## Analysis All scripts were audited with: - `grep -rn` for: `urlopen`, `requests.`, `subprocess`, `os.system`, `eval(`, `exec(`, `os.environ`, `getenv`, `shutil.rmtree`, `os.remove`, `chmod`, `pickle`, `marshal`, `__import__` - Only hit: `api_load_tester.py` in senior-backend uses `urllib` — which is its entire purpose as a load testing tool. - Reference markdown files in senior-backend contain code examples mentioning JWT secrets and passwords — these are educational content, not executable code. ## Request Please unflag all 4 skills. The VirusTotal Code Insight scanner appears to be triggering on: 1. Presence of Python scripts (regardless of content) 2. Security-related terminology in reference documentation 3. Network-related stdlib imports in tools explicitly designed for HTTP testing Thank you!
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
bug
pull-request
Mirrored from GitHub Pull Request
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
yindo
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: openclaw/clawhub#200
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?