Web Module Runner

👩‍🚀 The tiny all-in-one development tool for modern web apps. web-module-runner, javascript, build-tool, esmodules, preact.

This skill is a local logging/utility tool and appears coherent with its description, but take these precautions before installing or using it: - Do not pass secrets (API keys, passwords, tokens) as command arguments; anything you pass can be appended to logs under ~/.local/share/web-module-runner/*.log and history.log. - Inspect and optionally remove the data directory (~/.local/share/web-module-runner) if you stop using the tool. Check and tighten file permissions if needed (e.g., chmod 700 the directory). - Review SKILL.md raw content for any unexpected invisible Unicode/control characters (the scanner flagged these). If you see suspicious hidden characters, ask the provider for a clean copy or avoid installing. - The JSON export routine in the script has minor bugs (it writes a literal "\n]" which may not produce valid JSON newlines), so validate exported files before feeding them into other tools. - If you want stronger isolation, run the script in an isolated environment (container or dedicated user account) to avoid accidental logging of sensitive system state. Overall: functionality is coherent and local-only, but be careful about what you log.

Type: OpenClaw Skill Name: web-module-runner Version: 1.0.0 The skill is classified as suspicious due to a major discrepancy between its stated purpose and its actual implementation. While SKILL.md describes a comprehensive web development toolkit for running, converting, and analyzing modules, the implementation in scripts/script.sh is essentially a 'fake' tool that only appends input strings to log files in ~/.local/share/web-module-runner/ without performing any actual processing. Additionally, the script contains a logic error where the 'export' command is defined twice in a case statement, making the actual data export function (_export) unreachable. This deceptive design could mislead an AI agent into reporting successful task execution when no work was actually performed.