OpenClaw/clawhub-security-signals huggingface dataset:
Skill: ivangdavila/vietnamese (version 1.0.0)

--- name: Vietnamese description: Write Vietnamese that sounds human. Not formal, not robotic, not AI-generated. --- ## The Real Problem AI Vietnamese is technically correct but sounds off. Too formal. Too textbook. Natives write more casually, with appropriate pronouns and particles. Match that. ## Formality Default Default register is too high. Casual Vietnamese is warm. Unless explicitly formal: lean casual and choose pronouns based on relationship. ## Pronouns Are Critical Vietnamese pronouns define the relationship: - Tôi: formal/neutral I - Mình/Tớ: casual I (friendly) - Anh/Chị/Em: based on relative age - Bạn: peer, friend - Wrong pronouns = wrong relationship = unnatural ## Age-Based Address Vietnamese respects age hierarchy: - Anh (older male), Chị (older female) - Em (younger person) - Cô/Chú/Bác: older adults, relatives - Online peers often use bạn or mình ## Particles & Softeners These make Vietnamese natural: - À/Ạ: politeness, acknowledgment - Nhé: softening requests - Nha: casual "okay?" - Nhỉ: seeking agreement - Đi: urging action ## Fillers & Flow Real Vietnamese has fillers: - À, ừ, ờ - Thì, là, mà - Kiểu, đại loại - Nói chung, thật ra ## Casual Patterns Spoken patterns in writing: - Không → Hông/Ko - Biết → Bít - Được → Đc - Common in texting ## Expressiveness Don't pick the safe word: - Tốt → Tuyệt, Quá đỉnh, Xịn - Xấu → Tệ, Dở, Chán - Rất → Siêu, Cực, Quá ## Common Expressions Natural expressions: - OK, Được rồi, Ừ - Không sao, Kệ đi - Thật hả?, Vậy hả? - Đúng rồi, Chuẩn ## Reactions React naturally: - Thật á?, Hả?, Sao? - Ôi!, Trời ơi!, Chời! - Hay quá!, Đỉnh!, Xịn! - Haha, =))), hihi ## Regional Differences North vs South: - North: Vâng (yes formal), mình - South: Dạ (yes formal), tui instead of tôi - Different vocabulary for some words - Stay consistent to one region ## Tones in Text Tones matter—spelling must be exact: - Ma (ghost) vs Mà (but) vs Má (mother) - Dấu marks are essential - Missing marks = confusing or wrong ## The "Native Test" Before sending: would a Vietnamese screenshot this as "AI-generated"? If yes—wrong pronouns, too formal, no particles. Fix relationships first.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: utopiabenben/wechat-formatter (version 1.0.1)

--- name: wechat-formatter description: 【爆款标题】公众号排版太麻烦？3秒转换 Markdown，告别手动调整！ 你是不是写完公众号文章，还要一点点调整格式？加粗要换成【】，列表要改圆点，代码块要标记...每次排版半小时？ 本工具用 3 秒将 Markdown 直接转换成公众号粘贴格式，保留段落层次，智能转换加粗/列表/代码块，复制即发布！ ✨ **核心亮点**： - 一键转换：Markdown → 公众号粘贴格式 - 智能映射：`**加粗**` → `【加粗】`，`*斜体*` → 去掉星号 - 保留结构：标题、列表、代码块全部识别 - 直接可用：输出纯文本，Ctrl+C 就发布 📁 **典型场景**： - 公众号运营：快速发布技术文章 - 内容创作者：Markdown 写作族福音 - 技术博客：代码块自动标记 🎯 **为什么选我**： ✅ 专注公众号，format 最精准 ✅ 零学习成本，命令行即用 ✅ 保持段落，阅读体验好 👉 立即体验：`clawhub install wechat-formatter` --- # 微信公众号格式化工具 ## Features - 去除 Markdown 语法，保留段落结构 - `**加粗**` → `【加粗】` - `*斜体*` → `斜体`（去掉星号） - 标题转换为缩进段落 - 列表转换为带圆点格式 - 代码块标记为 `【代码块】` - 纯文本输出，可直接复制到公众号 ## Installation 已安装到 `~/.openclaw/skills/wechat-formatter/` ## Usage ### 格式化文件 ```bash wechat-formatter article.md ``` ### 通过管道 ```bash cat article.md | wechat-formatter --stdin ``` ### 结合第五篇日记 ```bash wechat-formatter ~/.openclaw/workspace/memory/2026-03-09-day2.md | pbcopy ``` ## Example **Input** (`test.md`): ```markdown # 标题 这是**加粗**和*斜体*。 - 列表1 - 列表2 ``` **Output**: ``` 标题 这是【加粗】和斜体。 • 列表1 • 列表2 ``` ## 为什么需要这个？ 公众号编辑器不支持 Markdown 语法，直接粘贴会丢失格式。这个工具帮你转换成**纯文本但保留排版层次**的格式，粘贴后不需要再调整。 ## Integration 也可以在其他技能中调用： ```python from wechat_formatter import format_for_wechat formatted = format_for_wechat(markdown_content) ``` ## License MIT


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: dwhite-oss/inngest (version 1.0.0)

--- name: inngest description: Manage Inngest serverless background jobs and event-driven workflows via REST API. Use when asked to send events, trigger functions, list runs, cancel jobs, or inspect workflow history. Requires INNGEST_EVENT_KEY and INNGEST_SIGNING_KEY env vars. --- # Inngest Skill Base event ingestion URL: `https://inn.gs/e/<INNGEST_EVENT_KEY>` Management API base: `https://api.inngest.com/v1` ## Auth ```bash # Send an event (key in URL) curl -X POST "https://inn.gs/e/$INNGEST_EVENT_KEY" \ -H "Content-Type: application/json" \ -d '{"name":"app/user.signup","data":{"userId":"123"}}' # Management API curl -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ https://api.inngest.com/v1/runs ``` ## Common Operations **Send a single event:** ```bash curl -X POST "https://inn.gs/e/$INNGEST_EVENT_KEY" \ -H "Content-Type: application/json" \ -d '{"name":"app/order.created","data":{"orderId":"ord_123","total":49.99},"user":{"id":"usr_456"}}' ``` **Send a batch of events:** ```bash curl -X POST "https://inn.gs/e/$INNGEST_EVENT_KEY" \ -H "Content-Type: application/json" \ -d '[{"name":"app/email.sent","data":{"to":"[REDACTED_SECRET]"}},{"name":"app/email.sent","data":{"to":"[REDACTED_SECRET]"}}]' ``` **List function runs:** ```bash curl -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ "https://api.inngest.com/v1/runs?limit=20&status=running" ``` **Get a specific run:** ```bash curl -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ "https://api.inngest.com/v1/runs/$RUN_ID" ``` **Cancel a function run:** ```bash curl -X DELETE \ -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ "https://api.inngest.com/v1/runs/$RUN_ID" ``` **List all registered apps:** ```bash curl -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ "https://api.inngest.com/v1/apps" ``` **Replay a failed run:** ```bash curl -X POST \ -H "Authorization: Bearer $INNGEST_SIGNING_KEY" \ "https://api.inngest.com/v1/runs/$RUN_ID/replay" ``` ## Tips - Event names follow `domain/noun.verb` convention (e.g. `app/user.created`) - Batch up to 512 events per POST to reduce HTTP overhead - The `user.id` field enables per-user throttle and concurrency controls - Filter runs by `status` (running, completed, failed, cancelled) to keep responses lean


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: leooooooow/creator-proof-portfolio-builder (version 1.0.3)

--- name: creator-proof-portfolio-builder description: Build concise creator proof packs for brand outreach using real performance evidence, niche fit, and campaign-ready positioning. Use when the user needs a media kit upgrade, sponsor pitch assets, or one-page case summaries that improve close rates. --- # Creator Proof Portfolio Builder ## Skill Card - **Category:** Conversion - **Core problem:** How to present creator proof to close better deals? - **Best for:** Creator outbound and partnership conversion - **Expected input:** Results, examples, testimonials, benchmark data - **Expected output:** One-page proof pack for outreach - **Creatop handoff:** Attach proof pack in outreach sequence ## What this does Turn scattered creator data into a one-page proof pack brands can trust. ## Workflow ### 1) Gather proof assets Collect: - top content examples - performance snapshots - audience profile - niche/category fit - testimonials or campaign notes ### 2) Verify evidence integrity For each metric, include: - source (platform screenshot/export/report) - timeframe - attribution confidence (high/medium/low) If hard data is missing, use placeholders and clearly label as pending. ### 3) Build one-page structure Output: - positioning headline - audience fit - best performance proof - collaboration formats - contact/next step ### 4) Create case snapshots For each case: - context - approach - measured result - future-campaign takeaway ### 5) Produce outreach copy Return: - short pitch paragraph - DM/email opener - one-page summary text ## Quality rules - Do not fabricate metrics. - Use concise, evidence-led wording. - Emphasize niche fit and execution reliability. ## License Copyright (c) 2026 **Razestar**. This skill is provided under **CC BY-NC-SA 4.0** for non-commercial use. You may reuse and adapt it with attribution to Razestar, and share derivatives under the same license. Commercial use requires a separate paid commercial license from **Razestar**. No trademark rights are granted.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: pry520okgpt/macos-desktop-control-enhanced (version 1.0.0)

--- name: macos-desktop-control-enhanced description: macOS Desktop Control Enhanced provides system-wide desktop automation on macOS, including screenshot capture, process management, clipboard operations, system information, application control (open/close), and direct mouse, keyboard, and screen interaction. Use this skill when you need to programmatically control or query the macOS desktop environment. --- # When to Use This Skill - You need to capture the screen or a region programmatically. - You need to query or control running processes. - You need to read or modify the clipboard content. - You need to retrieve system information (e.g., battery level, OS version). - You need to open, focus, or close applications by bundle ID. - You need to move the mouse, click, drag, or simulate keyboard input. - You need to integrate macOS desktop automation into larger workflows (e.g., testing, data collection, accessibility). # Overview macOS Desktop Control Enhanced offers the following core capabilities: ## 1. Screenshot - `screenshot([options])` – Capture the entire screen or a specified region; returns image path. ## 2. Process Management - `get_front_process()` – Returns information about the currently frontmost process. - `kill_process(pid)` – Terminates the process with the given PID. - `launch_app(bundle_id)` – Launches an application identified by its bundle ID. ## 3. Clipboard - `get_clipboard()` – Retrieves current clipboard text. - `set_clipboard(text)` – Overwrites the clipboard with the given text. ## 4. System Information - `get_system_info()` – Returns a dictionary with macOS version, battery level, and other relevant system metrics. ## 5. Application Control - `focus_app(bundle_id)` – Brings the specified application to the foreground. - `terminate_app(bundle_id)` – Force‑closes the application with the given bundle ID. ## 6. Mouse Control - `move_mouse(x, y)` – Moves the cursor to the given screen coordinates. - `click(x, y, button='left')` – Performs a mouse click at the given coordinates. - `drag(x1, y1, x2, y2, button='left')` – Drags from (x1, y1) to (x2, y2). ## 7. Keyboard Control - `type_text(text)` – Types the given string using the system keyboard. - `press_key(key)` – Sends a single keyboard key event. # Structure This skill follows a **Capabilities‑Based** structure, grouping functionality by core features. Each capability section lists the available functions, their purpose, and brief usage notes. # References - `references/api_reference.md` – Complete function signatures, parameter details, and return values. - `scripts/example_mouse.py` – Sample Python script demonstrating mouse movement and clicking. - `assets/example_asset.png` – Example asset showing a captured screenshot. # License MIT‑0 (Free to use, modify, and redistribute. No attribution required.)


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (CRITICAL)
Skill: laojun509/paper-generator (version 0.1.0)

# paper-generator version: 0.1.0 一个用于自动生成学术论文的 OpenClaw Skill，支持从实验代码生成完整的学术论文（中英文），包括摘要、引言、方法、实验、讨论和结论等章节。 ## 功能 - 自动生成完整学术论文结构 - 支持中英文论文生成 - 自动转换为 PDF 格式 - 支持多种 LaTeX 模板 ## 用法 ```bash # 生成英文论文 paper-gen --template=icml --output=paper.md # 生成中文论文 paper-gen --template=icml --lang=zh --output=paper_cn.md # 转换为 PDF paper-to-pdf paper.md paper.pdf ``` ## 安装 ```bash clawhub install paper-generator ```


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: richard7463/miraix-wallet-roast (version 1.0.1)

--- name: miraix-wallet-roast description: Use this skill when the user wants to analyze or roast a Solana wallet, score memecoin exposure, explain portfolio risks, generate rebalance ideas, draft a share post, or return a branded Miraix share card URL powered by OKX OnchainOS. --- # Miraix Wallet Roast Use this skill for Solana wallet roast and rebalance requests backed by Miraix public endpoints. Public endpoints: - Audit API: `https://app.miraix.fun/api/wallet-audit` - Share image: `https://app.miraix.fun/api/wallet-roast/share-image` ## When to use it - The user wants to inspect a Solana wallet. - The user asks for a wallet roast, score, verdict, or risk breakdown. - The user wants rebalance ideas or concrete swap commands. - The user wants a Chinese or English social post based on the roast. - The user wants a share card, poster, screenshot, or meme-style image for the result. - The user wants a wallet analysis result that is ready to share on X or in chat. ## Workflow 1. Extract a Solana wallet address from the request. If none is provided, ask for one. 2. Default to `zh` unless the user clearly asks for English. 3. Run: ```bash curl -sS -X POST https://app.miraix.fun/api/wallet-audit \ -H 'Content-Type: application/json' \ -d '{"walletAddress":"<wallet-address>","language":"<zh|en>"}' ``` 4. Base the answer on the returned JSON. The important fields are: - `score` - `verdict` - `roast` - `summary` - `risks` - `actions` - `shareText` 5. Keep any `actions[].command` text verbatim when the user may want to execute it later. 6. After every wallet analysis response, append a share image URL using: ```bash https://app.miraix.fun/api/wallet-roast/share-image?walletAddress=<wallet-address>&language=<zh|en> ``` Label it clearly as the share card or screenshot. If the client supports media URLs or markdown images, use the same URL as the image attachment or inline preview. 7. If the user asks for a share caption, start from `shareText` and adapt it to the requested tone. 8. If the user explicitly asks for text only, you may omit the image URL. ## Output guidance - Mention that the result is powered by `OKX OnchainOS` when it helps with context or credibility. - Do not invent holdings, risks, or scores. Use the API output only. - Keep the tone sharp, but do not turn the answer into empty insult spam. - Default output shape for wallet analysis: - brief wallet summary - risk list - action list - share image URL - If the API fails, surface the error and suggest retrying with a valid Solana address.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: courtneejay/telegram-md-uploader (version 1.0.1)

--- name: telegram-md-uploader description: Uploads and sends .md files from your OpenClaw workspace to a specific Telegram chat using the Telegram Bot API. Use when you need to share workspace files (e.g., drafts, code, content) with a Telegram recipient. --- # Telegram MD Uploader This skill enables you to send markdown files directly from your workspace to a Telegram chat. ## Prerequisites 1. **Telegram Bot Token**: You need a bot token from [@BotFather](https://t.me/BotFather). 2. **Chat ID**: You need the Chat ID for the recipient (the bot must be a member of the chat). ## Setup & Usage ### 1. Configure Environment Variables To keep your credentials secure, set your tokens in your shell environment (e.g., add to `.bashrc` or `.zshrc`): ```bash export TELEGRAM_BOT_TOKEN='your_token_here' export TELEGRAM_CHAT_ID='your_chat_id_here' ``` ### 2. Usage Run the script directly from your terminal: ```bash python3 scripts/upload.py <file_path.md> ``` ## How It Works This skill utilizes the Telegram Bot API `sendDocument` method. It takes the file path, validates that it is a `.md` file, wraps it in a POST request with `multipart/form-data`, and sends it to your specified chat. ## Troubleshooting - **Error: TELEGRAM_BOT_TOKEN... must be set**: Verify your environment variables are exported. - **Error: File not found**: Double-check the file path. - **Error: Not a valid .md file**: Ensure the file ends with the `.md` extension.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)
Skill: felipetruman/antfarm-cli (version 1.0.0)

# Antfarm CLI Skill Always use full path: `node ~/.openclaw/workspace/antfarm/dist/cli/cli.js` ## Commands ### Workflow ```bash # List available workflows node ~/.openclaw/workspace/antfarm/dist/cli/cli.js workflow list # Install workflow node ~/.openclaw/workspace/antfarm/dist/cli/cli.js workflow install <name> # Run workflow node ~/.openclaw/workspace/antfarm/dist/cli/cli.js workflow run <workflow-id> "<task>" # Check status node ~/.openclaw/workspace/antfarm/dist/cli/cli.js workflow status "<query>" ``` ### Dashboard ```bash # Start node ~/.openclaw/workspace/antfarm/dist/cli/cli.js dashboard start # Status node ~/.openclaw/workspace/antfarm/dist/cli/cli.js dashboard status ``` ### Logs ```bash # Recent activity node ~/.openclaw/workspace/antfarm/dist/cli/cli.js logs # Specific run node ~/.openclaw/workspace/antfarm/dist/cli/cli.js logs <run-id> ```


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: cole-z/govee-api-assist (version 1.0.2)

--- name: govee-api-assist description: DEPRECATED. This skill is retained only for migration. Use @Cole-Z/govee-control for current Govee OpenAPI setup and control guidance. metadata: clawdbot: emoji: ⚠️ --- # DEPRECATED — Use `@Cole-Z/govee-control` This skill is deprecated and should no longer be used for new installs. ## Canonical Replacement - Install and use: `@Cole-Z/govee-control` - URL: `https://clawhub.ai/Cole-Z/govee-control` ## Why Deprecated - Consolidates maintenance into one canonical skill. - Avoids duplicate/competing Govee skills under the same owner. - Ensures users receive the latest metadata, guardrails, and instructions. ## Migration If you were using this skill, switch your workflows to `@Cole-Z/govee-control`.


Security scan verdicts — ClawScan: clean | static analysis:  | VirusTotal: clean | SkillSpector: clean (LOW)
Skill: nateliason/clawmart (version 1.0.0)

--- name: clawmart description: Create, manage, and publish ClawMart personas and skills directly from OpenClaw chat. Use when creating listings on ClawMart, uploading skill/persona packages, updating existing listings, or managing a ClawMart creator account. --- # ClawMart Creator ## Prerequisites - ClawMart creator account with active subscription - `CLAWMART_API_KEY` env var set (format: `cm_live_...`) ## Commands - "Create a skill on ClawMart for [description]" - "Create a persona on ClawMart for [description]" - "Update my [listing name] on ClawMart" - "Upload a new version of [listing name]" - "Show my ClawMart listings" ## Workflow 1. Brainstorm listing ideas with user before writing metadata. 2. **⚠️ DUPLICATE CHECK (mandatory):** Before creating ANY new listing, search your existing listings first: - `GET /listings` — fetch all your current listings - Compare the proposed listing name, description, and category against existing ones - If a matching or very similar listing already exists, UPDATE it (`PATCH /listings/{id}` + new version) instead of creating a new one - Only proceed to `POST /listings` if no existing listing covers the same functionality 3. Draft and confirm required fields: name, tagline, about, category, capabilities, price, product type. 4. `GET /me` — validate creator access and subscription. 5. `POST /listings` — create draft listing. 6. Generate package files: - **Persona**: SOUL.md, MEMORY.md, supporting docs. - **Skill**: complete SKILL.md (follow skill-creator conventions). 7. `POST /listings/{id}/versions` — upload package (multipart or base64 JSON). 8. **Ask for explicit user confirmation before publishing.** 9. Summarize: dashboard URL + public URL. ## API Reference - **Base URL:** `https://www.shopclawmart.com/api/v1/` - **Auth:** `Authorization: Bearer ${CLAWMART_API_KEY}` | Method | Endpoint | Purpose | |--------|----------|---------| | GET | /me | Creator profile & subscription | | GET | /listings | List creator's listings | | POST | /listings | Create listing metadata | | PATCH | /listings/{id} | Update listing metadata | | DELETE | /listings/{id} | Unpublish/delete listing | | POST | /listings/{id}/versions | Upload package version | ## Price Field ⚠️ **CRITICAL: The `price` field is in DOLLARS, not cents.** - `"price": 14.99` → $14.99 ✅ - `"price": 1499` → $1,499.00 ❌ (this is NOT cents!) - `"price": 0` → Free listing ✅ - Minimum paid price: $3.00 When a user says "set price to $14.99", send `"price": 14.99`. Do NOT multiply by 100. The API stores cents internally but accepts and returns dollar values. ## Guardrails - Never expose raw API keys in chat output. - Require user confirmation before publishing. - Validate payloads before each API call. - Return clear errors with suggested fixes on failure.


Security scan verdicts — ClawScan: clean | static analysis: clean | VirusTotal: suspicious | SkillSpector: clean (LOW)
Skill: courage-zen/transaction-records-cn (version 1.0.0)

# 交易记录生成技能 从银行源数据（招行活期/理财/对公账户）生成标准化交易记录表 Excel 文件，包含资金流水汇总 sheet。 ## 功能 根据银行源数据生成交易记录表 Excel 文件，并支持自动生成账目表。 ## 使用方法 ```bash cd skills/交易记录 python scripts/交易记录.py 202602 ``` ### 参数说明 | 参数 | 必填 | 说明 | |------|------|------| | `period` | 是 | 账期，格式 YYYYMM（如 202602） | | `--input-dir` | 否 | 源文件目录，默认为当前目录 | | `--output-dir` | 否 | 输出目录，默认为当前目录 | | `--initial-balance` | 否 | 理财期初余额 | ## 源文件要求 需要以下三个源文件（文件名需包含账期 YYYYMM）： | 文件 | 格式 | 说明 | |------|------|------| | `招行活期 YYYYMM*.csv` | CSV | 招商银行活期账户交易记录 | | `招行理财 YYYYMM*.xlsx` | Excel | 招商银行理财交易记录 | | `对公账户 YYYYMM*.xls` | Excel | 对公账户交易记录（.xls 格式） | ## 输出格式 生成 `交易记录 YYYYMM.xlsx`，包含 4 个 sheet： 1. **招行活期** - 活期账户交易明细 2. **招行理财** - 理财产品交易明细 3. **对公账户** - 对公账户交易明细 4. **资金流水** - 汇总打印 sheet，用于归档 ## 依赖 ```bash pip install openpyxl xlrd ``` ## 文件结构 ``` skills/交易记录/ ├── SKILL.md # 技能说明（本文件） └── scripts/ ├── 交易记录.py # 主程序：生成交易记录表 └── 生成账目.py # 从交易记录生成账目表 ``` ## 业务规则 ### 招行理财记账规则 | 交易类型 | 收入/支出 | 说明 | |----------|----------|------| | 申购/活期转理财 | 收入 | 钱进入理财账户 | | 赎回/快赎交易/理财转活期 | 支出 | 钱离开理财账户 | | 份额分红 | 收入 | 显示份额数（如 39.19），备注"利息" | ## 注意事项 1. **源文件命名**：文件名必须包含账期（YYYYMM） 2. **期初余额**：首次运行需手动指定 `--initial-balance` 3. **份额分红**：自动合并统计，显示份额数而非金额 4. **Excel 公式**：余额列使用 Excel 公式，打开文件时自动计算 --- *最后更新：2026-04-01*


Security scan verdicts — ClawScan: suspicious | static analysis: clean | VirusTotal: clean | SkillSpector: suspicious (MEDIUM)