Skills/ClawHub/lgd-bootstrap

lgd-bootstrap@1.2.4

VERIFIED

Publisher claims: "Take a person or an agent from zero to a running three-law setup: get the install command and a one-line definition, score yourself against the three laws, then walk passport, evidence chain, gate and badge end to end. Fastest onboarding path into LGD (Lifecycle Governance Doctrine): 10s to the canonical one-line definition and install command, 1min to run the three-laws self-audit scorecard, 5min to complete the passport-evidence-gate-badge loop, plus the full LGD ecosystem store map (theory / engine / skills / evaluation). 任何人 / 任何 AI 的 LGD 最短入场路径。10 秒拿到安装命令与一句话定义，1 分钟跑三律自检评分卡，5 分钟走完 passport→证据链→门禁→徽章 闭环，并获得 LGD 生态超市全图（理论 / 引擎 / 技能 / 评测四层）。触发词：LGD、三律、有籍有证有门禁、生态超市、入场、快速开始、onboarding、getting started、伪绿、假绿。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher zhaoxinghua09-cell · joined 10 days agoInstalls 17Last detonated 1 h ago
$clawhub install lgd-bootstrap
WatchReport an issue

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario) on 2026-11-06 and scored it 88/100 (Verified). It did what it claims and nothing else we could detect: no undeclared network egress, no credential reads, no persistent instruction writes. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 0 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.0sprocessno install scripts to re-run

Static findings

MEDIUM
npx invocation of non-well-known packageSKILL.md:34 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
npx invocation of non-well-known packageSKILL.md:126 · npx invocation of non-well-known package — may execute untrusted codeFix: Pin versions and sources; vendor anything fetched at install time.
AST06

Cost to the agent

Instructions loaded
≈2,019 tok
1 file · 7 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.