Latest release: v2026.5.28Download zip
Capabilities
Compatibility
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The package purpose is moderator-only ClawHub operations, and the observed capabilities match that purpose: user bans/unbans, role changes, report triage, rescans, package moderation, trusted publisher settings, and org/package repairs.
Instruction Scope
The runtime behavior is exposed through explicit CLI commands; high-impact actions generally require a reason, confirmation, --yes, or --apply/dry-run flow, and server-side RBAC is required.
Install Mechanism
The package defines a CLI bin and build/typecheck scripts, with no package-level preinstall/postinstall hooks found in the reviewed package metadata.
Credentials
Network calls to the configured ClawHub registry, local config access, and optional CSV/result-file handling are proportionate for a moderation operator CLI.
Persistence & Privilege
It reuses/stores a ClawHub API token in the shared CLI config with restricted file permissions and uses it for RBAC-gated API calls; no background worker or hidden persistence was found.
Scan Findings in Context
[VirusTotal:clean] expected: VirusTotal telemetry reported 0 malicious and 0 suspicious detections, which is consistent with the reviewed artifacts.
[SkillSpector:clean] expected: SkillSpector reported no issues; local artifact review did not find contradictory hidden or purpose-mismatched behavior.
[static-review:moderator-api-authority] expected: The package has high-impact admin authority, but it is clearly documented as a moderator CLI and scoped to ClawHub registry operations under authenticated user control.
[static-review:local-token-config] expected: Use of a local bearer token is expected for authenticated CLI operations and is disclosed through login/whoami/logout commands.
Assessment
Install or run this only if you are a ClawHub maintainer or moderator and understand that its commands can change user, org, skill, and package state. Use dry-run modes where available, keep the CLI token protected, and prefer an isolated CLAWHUB_CONFIG_PATH for testing.