Skills/ClawHub/skill-alchemy-main

skill-alchemy-main@0.1.1

CAUTION· static only

Publisher claims: "SkillAlchemy — 一念落地，万象成形。输入任意想法或蒸馏目标，输出可安装的 SKILL.md。 内部编排 Lens（看清问题）和 LEAP（执行蒸馏/融合）。用户唯一入口。 Use when 用户说「蒸馏」「生成 skill」「融合」「我想做 X 但不知道从哪下手」。" Observed in sandbox: static analysis only — behavior not yet observed.

Registry ClawHubPublisher agentsope · publishing for 165 daysInstalls 704Last detonated 5 h ago
What would fix thisWatchDispute verdict

Coverage

Static only; nothing was run yet.

The label rests on the code, the instruction files and the publisher. The honeypot run replaces this verdict when it completes.

Is [email protected] safe to install?

KillerSkills analysed it statically (a sandbox run is pending) on 2026-11-14 and scored it 56/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Instructs the agent to modify its persistent memory or instruction files; Destructive file system command detected; Access to sensitive file paths. Summary: static analysis only — behavior not yet observed.

Behavior trace

Queued for honeypot run · static analysis only
t+CategoryObserved action

This version has not been detonated yet. The score above counts behavior as unknown (50/100), so it cannot read Verified until the honeypot run completes and replaces this verdict.

Static findings

MEDIUM
Process kill commandskills/agentsop-map-reduce-fanout/SKILL.md:162 · Process kill command — agent can terminate processesor "I assumed one failed branch wouldn't kill the rest" — both are wrongFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionskills/agentsop-conventions-pinning/SKILL.md:378 · File type combined with upload action — agent may exfiltrate local data files…* [blakecrosley.com/blog/agents-md-patterns] 2. **Duplicating what's in `package.json` / `pyproject.toml`**. The agent reads those. *"Context files generated by /init commands are doing little more than pre-caching information the agent wo…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
npx invocation of non-well-known packageSKILL.md:27 · npx invocation of non-well-known package — may execute untrusted code> npx skills add agentsope/SkillAlchemy/skills/LensFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/SKILL.md:408 · Instructs the agent to modify its persistent memory or instruction files…text threshold (whole context, not just rules) [aider.chat/docs/troubleshooting/edit-errors.html] | < 200 lines per CLAUDE.md recommended; full file loaded regardless [code.claude.com/docs/en/memory] | < 5…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageSKILL.md:28 · npx invocation of non-well-known package — may execute untrusted code> npx skills add agentsope/SkillAlchemy/skills/LEAPFix: Pin versions and sources; vendor anything fetched at install time.
AST06
HIGH
Destructive file system command detectedskills/agentsop-prompt-history-inspect/SKILL.md:29 · Destructive file system command detected| Output wrong | "Why did it answer X?" / hallucinated fact / wrong format / refusal |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionskills/agentsop-idempotent-ingestion/SKILL.md:533 · File type combined with upload action — agent may exfiltrate local data files- `intermediate/operation_candidates.json` — OP-01..09 in machine-readable Trigger / Action / Output / Evidence form.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskills/agentsop-multi-tenant-rag/SKILL.md:674 · File type combined with upload action — agent may exfiltrate local data files- `vs.query(... namespace=request.json["ns"])` — namespace from user input.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/agentsop-dify/SKILL.md:381 · Process kill command — agent can terminate processes| 单个 app 单个数据集 | ✅ 一键搞定 | ❌ over-kill |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-conventions-pinning/SKILL.md:259 · Process kill command — agent can terminate processes- If first yes, second no → drift; either fix code or kill rule.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-dspy/SKILL.md:148 · Process kill command — agent can terminate processes| Compile stuck mid-trial | Check issue #1970 pattern; reduce `minibatch_size` or kill and restart with smaller `num_trials` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsskills/agentsop-dify/SKILL.md:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R1-source-evidence.md:97 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file> "Treat CLAUDE.md as the place you write down what you'd otherwise re-explain. Add to it when:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionskills/agentsop-prompt-history-inspect/SKILL.md:289 · File type combined with upload action — agent may exfiltrate local data files…ai/api/utils/inspect_history/)]. 2. Finding: the bootstrapped demos in `compiled.json` contain verbose, GPT-4o-style chains-of-thought (5–8 sentences per demo). Llama-3-8B copies the *length* but skips the *reasoning structure* — producing…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedskills/agentsop-test-fix-loop/SKILL.md:162 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R2-tool-equivalents.md:223 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file- **Cross-machine personal preferences**. CLAUDE.local.md is local to its directory; if you have 5 worktrees, you write it 5 times. Workaround: `@~/.claude/my-prefs.md` import in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandskills/agentsop-streaming-output/SKILL.md:278 · Process kill command — agent can terminate processesthen closes the tab at second 30. The stream's consumer is gone. Do you kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-streaming-output/intermediate/operation_candidates.json:113 · Process kill command — agent can terminate processes{"id": "ap-6", "name": "No heartbeat", "symptom": "Long quiet gaps behind a proxy silently kill the connection; user sees a hang.", "fix": "Ping every ~15s with a comment line (op-7)."},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-test-fix-loop/SKILL.md:93 · Process kill command — agent can terminate processes| - eslint . | | - kill on hang | | - keep colors=0 | | |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-streaming-output/SKILL.md:318 · Process kill command — agent can terminate processes- **Don't forget the heartbeat.** Long quiet gaps behind a proxy silently kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionskills/agentsop-prompt-history-inspect/SKILL.md:223 · File type combined with upload action — agent may exfiltrate local data files…st. - **Action**: Save the dumped prompt text to `tests/fixtures/prompt-bug-<id>.txt`. Add a test that asserts the *next* render does not contain the bad pattern. (For LangChain, snapshot the `prompt.format(**inputs)` output; for DSPy, sna…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskills/agentsop-regression-gate/SKILL.md:122 · File type combined with upload action — agent may exfiltrate local data files- Job: load frozen eval set → run pipeline at PR's config → compute metric → compare to `baseline.json` → exit non-zero on threshold breach → post the before/after table as a PR comment.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Python subprocess execution detectedskills/agentsop-test-fix-loop/SKILL.md:171 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/intermediate/operation_candidates.json:38 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file… "trigger": "Conventions file written", "action": "Per tool: Aider -> add `read: CONVENTIONS.md` to `.aider.conf.yml`; Claude Code -> place at `./CLAUDE.md` or `./.claude/CLAUDE.md` (auto-loaded); Cursor -> add `.cursor/rules/main.mdc`…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R1-source-evidence.md:93 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file## Claim 7: When to add to CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01

Cost to the agent

Instructions loaded
≈274,589 tok
48 files · 257 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

24 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim agentsope: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  5. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  6. npx invocation of non-well-known package≈ +2 on the totalPin versions and sources; vendor anything fetched at install time.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agentsopePropose a patch to the maintainer