Is ui-theme-coach safe to install?

ui-theme-coach was flagged as LOW RISK (risk score 2) with 1 finding detected across 17 files. Review the findings before installing.

What security issues were found in ui-theme-coach?

Sigil detected 1 finding in ui-theme-coach, including patterns related to install_hooks. See the full scan report for details.

Scans/clawhub/ui-theme-coach

ui-theme-coach

clawhub

Summary

ui-theme-coach v1.5.0 was classified as LOW RISK with a risk score of 2. Sigil detected 1 finding across 17 files, covering phases including install hooks. Review the findings below before installing this package.

Package description: 引导式 UI 主题设计顾问：通过问答引导帮用户定制任意风格的 OpenClaw Control UI 主题（像素/赛博朋克/卡通/极简/暗色科技等），含主色派生调色板、双保险注入、升级自愈（cron+快照）与反馈学习循环。触发词：主题、换皮、皮肤、UI 美化、风格。

LOW RISK(2)

v1.5.0

3 September 2026, 05:16 UTC

by Sigil Bot

Risk Score

Findings

Files Scanned

Provenance

Registry

https://clawhub.com/skills/ui-theme-coach

Scanned From

https://clawhub.ai/api/v1/download?slug=ui-theme-coach&version=1.5.0

Findings by Phase

•

Phase Ordering

Phases are ordered by criticality, with the most dangerous at the top. Click any phase header to expand or collapse its findings. Critical phases are expanded by default.

install-makefile-curl

LOW

Makefile/script pipes remote content to shell

SKILL.md:331

- [ ] frontmatter 按 Agent Skills 标准自查（name 规则 7 条 / description ≤1024 / 缺 description 不加载），清单+自动化脚本见 `references/open-source-checklist.md`
- [ ] 安全审计：注入代码/素材零外链、字体纹理全部本地化（web 调研/curl 校验属开发期行为，不进注入产物）、无敏感文件读取、无 curl|bash 模式

Why was this flagged?

A script or Makefile pipes content from a remote URL directly into a shell (curl | sh or wget | bash). This is inherently dangerous because the remote content can change at any time, and the command runs with the current user's permissions. Rated HIGH because it requires manual execution (unlike install hooks) but still executes arbitrary remote code.

Badge

Markdown

[![Sigil Scan](https://sigilsec.ai/badge/clawhub/ui-theme-coach)](https://sigilsec.ai/scans/BB620EA2-FEEC-430D-8F87-D58F94DD7235)

HTML

<a href="https://sigilsec.ai/scans/BB620EA2-FEEC-430D-8F87-D58F94DD7235"><img src="https://sigilsec.ai/badge/clawhub/ui-theme-coach" alt="Sigil Scan"></a>

Run This Scan Yourself