{"record":{"id":"7bc1e148180c4573","repo":"sipeed/picoclaw","slug":"skill-s-is-flagged-as-malicious-and-cannot-be","errorCode":null,"errorMessage":"✗ Skill '%s' is flagged as malicious and cannot be installed.\n","messagePattern":"✗ Skill '(.+?)' is flagged as malicious and cannot be installed\\.\n","errorType":"validation","errorClass":null,"httpStatus":null,"severity":"error","filePath":"cmd/picoclaw/internal/skills/helpers.go","lineNumber":100,"sourceCode":"\t\treturn fmt.Errorf(\"\\u2717 failed to create skills directory: %w\", err)\n\t}\n\n\tresult, err := registry.DownloadAndInstall(ctx, target, \"\", targetDir)\n\tif err != nil {\n\t\trmErr := os.RemoveAll(targetDir)\n\t\tif rmErr != nil {\n\t\t\tfmt.Printf(\"\\u2717 Failed to remove partial install: %v\\n\", rmErr)\n\t\t}\n\t\treturn fmt.Errorf(\"✗ failed to install skill: %w\", err)\n\t}\n\n\tif result.IsMalwareBlocked {\n\t\trmErr := os.RemoveAll(targetDir)\n\t\tif rmErr != nil {\n\t\t\tfmt.Printf(\"\\u2717 Failed to remove partial install: %v\\n\", rmErr)\n\t\t}\n\n\t\treturn fmt.Errorf(\"\\u2717 Skill '%s' is flagged as malicious and cannot be installed.\\n\", target)\n\t}\n\n\tif result.IsSuspicious {\n\t\tfmt.Printf(\"\\u26a0\\ufe0f  Warning: skill '%s' is flagged as suspicious.\\n\", target)\n\t}\n\n\tif !workspaceHasValidSkillDirectory(workspace, dirName) {\n\t\t_ = os.RemoveAll(targetDir)\n\t\treturn fmt.Errorf(\"✗ failed to install skill: registry archive for %q is not a valid skill\", target)\n\t}\n\n\tnormalizedSlug, registryURL := skills.BuildInstallMetadataForRegistryInstance(registry, target, result.Version)\n\tinstalledAt := time.Now().UnixMilli()\n\tif err := writeInstalledSkillOriginMeta(targetDir, installedSkillOriginMeta{\n\t\tVersion:          1,\n\t\tOriginKind:       \"third_party\",\n\t\tRegistry:         registry.Name(),\n\t\tSlug:             normalizedSlug,","sourceCodeStart":82,"sourceCodeEnd":118,"githubUrl":"https://github.com/sipeed/picoclaw/blob/49183d7e8daed0dba89ddbb6fcb60089401d9680/cmd/picoclaw/internal/skills/helpers.go#L82-L118","documentation":"The registry's malware scan flagged the skill: result.IsMalwareBlocked was true after download, so installation is refused, the partial directory is removed, and the skill cannot be installed through this path. This is a deliberate security stop, not a bug.","triggerScenarios":"The downloaded skill's files match the registry scanner's malware signatures/heuristics, setting result.IsMalwareBlocked at helpers.go:100.","commonSituations":"A genuinely malicious skill published to the registry, or a false positive on scripts that shell out, download files, or use obfuscated payloads.","solutions":["Do not bypass the block — inspect the skill's source on the registry first.","If it looks like a false positive, report it to the registry maintainers and wait for a clean scan.","Choose an alternative skill with similar functionality.","Audit the skill's scripts (SKILL.md and any shell/code files) before considering any manual install."],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"if err != nil && strings.Contains(err.Error(), \"flagged as malicious\") {\n    // hard stop: surface for human review — never retry or bypass\n    return fmt.Errorf(\"install blocked by malware scan: %w\", err)\n}","preventionTips":["Never script a bypass of malware blocks; treat them as a hard stop.","Prefer registries with active scanning and a reporting loop.","Review a skill's SKILL.md and scripts before installing it anywhere sensitive."],"tags":["security","malware","install","registry","go"],"backgroundTag":null,"analyzedSha":"49183d7e8daed0dba89ddbb6fcb60089401d9680","analyzedAt":"2026-08-15T21:55:41.315Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}