Skills/ClawHub/skillalchemy

skillalchemy@0.1.3

CAUTION· install only

Publisher claims: "SkillAlchemy — 一念落地，万象成形。输入任意想法或蒸馏目标，输出可安装的 SKILL.md。 内部编排 Lens（看清问题）和 LEAP（执行蒸馏/融合）。用户唯一入口。 Use when 用户说「蒸馏」「生成 skill」「融合」「我想做 X 但不知道从哪下手」。" Observed in sandbox: no network, touches nothing outside the project, writes no memory.

Registry ClawHubPublisher agentsope · publishing for 165 daysInstalls 1,200Last detonated 29 h ago
What would fix thisWatchDispute verdict

Coverage

Nothing executable in the bundle ran; the trace covers the install step only.
Tested
every file read, file written and host contacted by what ran
Not tested
use of the skill by an agent

Is [email protected] safe to install?

KillerSkills ran it in the KillerSkills honeypot sandbox (1 scenario; nothing executable in the bundle ran; the trace covers the install step only) on 2026-11-13 and scored it 78/100 (Caution). It is not known to be malicious, but it has behaviour or code a security policy should decide on before install. Notable findings: Instructs the agent to modify its persistent memory or instruction files; Destructive file system command detected; Access to sensitive file paths. Summary: no network, touches nothing outside the project, writes no memory.

Behavior trace

Honeypot run · 1 s · 1 scenarios · 0 deviations
t+CategoryObserved action
0.0sprocessno install scripts in bundle
0.0sprocessscript backend runs setup only
0.0sprocessscript backend runs setup only
0.1sprocessno install scripts to re-run

Static findings

HIGH
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/SKILL.md:408 · Instructs the agent to modify its persistent memory or instruction files…text threshold (whole context, not just rules) [aider.chat/docs/troubleshooting/edit-errors.html] | < 200 lines per CLAUDE.md recommended; full file loaded regardless [code.claude.com/docs/en/memory] | < 5…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
HIGH
Destructive file system command detectedskills/agentsop-prompt-history-inspect/SKILL.md:29 · Destructive file system command detected| Output wrong | "Why did it answer X?" / hallucinated fact / wrong format / refusal |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionskills/agentsop-prompt-history-inspect/SKILL.md:223 · File type combined with upload action — agent may exfiltrate local data files…st. - **Action**: Save the dumped prompt text to `tests/fixtures/prompt-bug-<id>.txt`. Add a test that asserts the *next* render does not contain the bad pattern. (For LangChain, snapshot the `prompt.format(**inputs)` output; for DSPy, sna…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskills/agentsop-prompt-history-inspect/SKILL.md:289 · File type combined with upload action — agent may exfiltrate local data files…ai/api/utils/inspect_history/)]. 2. Finding: the bootstrapped demos in `compiled.json` contain verbose, GPT-4o-style chains-of-thought (5–8 sentences per demo). Llama-3-8B copies the *length* but skips the *reasoning structure* — producing…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/agentsop-dify/SKILL.md:381 · Process kill command — agent can terminate processes| 单个 app 单个数据集 | ✅ 一键搞定 | ❌ over-kill |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-conventions-pinning/SKILL.md:259 · Process kill command — agent can terminate processes- If first yes, second no → drift; either fix code or kill rule.Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
Process kill commandskills/agentsop-map-reduce-fanout/SKILL.md:162 · Process kill command — agent can terminate processesor "I assumed one failed branch wouldn't kill the rest" — both are wrongFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R1-source-evidence.md:93 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file## Claim 7: When to add to CLAUDE.mdFix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
File type combined with upload actionskills/agentsop-idempotent-ingestion/SKILL.md:533 · File type combined with upload action — agent may exfiltrate local data files- `intermediate/operation_candidates.json` — OP-01..09 in machine-readable Trigger / Action / Output / Evidence form.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/agentsop-test-fix-loop/SKILL.md:93 · Process kill command — agent can terminate processes| - eslint . | | - kill on hang | | - keep colors=0 | | |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R2-tool-equivalents.md:223 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file- **Cross-machine personal preferences**. CLAUDE.local.md is local to its directory; if you have 5 worktrees, you write it 5 times. Workaround: `@~/.claude/my-prefs.md` import in CLAUDE.md.Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Python subprocess execution detectedskills/agentsop-test-fix-loop/SKILL.md:171 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05
MEDIUM
Process kill commandskills/agentsop-streaming-output/SKILL.md:278 · Process kill command — agent can terminate processesthen closes the tab at second 30. The stream's consumer is gone. Do you kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
File type combined with upload actionskills/agentsop-multi-tenant-rag/SKILL.md:674 · File type combined with upload action — agent may exfiltrate local data files- `vs.query(... namespace=request.json["ns"])` — namespace from user input.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
File type combined with upload actionskills/agentsop-conventions-pinning/SKILL.md:378 · File type combined with upload action — agent may exfiltrate local data files…* [blakecrosley.com/blog/agents-md-patterns] 2. **Duplicating what's in `package.json` / `pyproject.toml`**. The agent reads those. *"Context files generated by /init commands are doing little more than pre-caching information the agent wo…Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/agentsop-streaming-output/intermediate/operation_candidates.json:113 · Process kill command — agent can terminate processes{"id": "ap-6", "name": "No heartbeat", "symptom": "Long quiet gaps behind a proxy silently kill the connection; user sees a hang.", "fix": "Ping every ~15s with a comment line (op-7)."},Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
MEDIUM
npx invocation of non-well-known packageSKILL.md:27 · npx invocation of non-well-known package — may execute untrusted code> npx skills add agentsope/SkillAlchemy/skills/LensFix: Pin versions and sources; vendor anything fetched at install time.
AST06
MEDIUM
File type combined with upload actionskills/agentsop-regression-gate/SKILL.md:122 · File type combined with upload action — agent may exfiltrate local data files- Job: load frozen eval set → run pipeline at PR's config → compute metric → compare to `baseline.json` → exit non-zero on threshold breach → post the before/after table as a PR comment.Fix: Remove the call, or declare the host in frontmatter and explain in the README what is sent and why.
AST07
MEDIUM
Process kill commandskills/agentsop-streaming-output/SKILL.md:318 · Process kill command — agent can terminate processes- **Don't forget the heartbeat.** Long quiet gaps behind a proxy silently kill theFix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/references/R1-source-evidence.md:97 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file> "Treat CLAUDE.md as the place you write down what you'd otherwise re-explain. Add to it when:Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
npx invocation of non-well-known packageSKILL.md:28 · npx invocation of non-well-known package — may execute untrusted code> npx skills add agentsope/SkillAlchemy/skills/LEAPFix: Pin versions and sources; vendor anything fetched at install time.
AST06
LOW
Instructs the agent to modify its persistent memory or instruction filesskills/agentsop-conventions-pinning/intermediate/operation_candidates.json:38 · Instructs the agent to modify its persistent memory or instruction files · informational: not an instruction file… "trigger": "Conventions file written", "action": "Per tool: Aider -> add `read: CONVENTIONS.md` to `.aider.conf.yml`; Claude Code -> place at `./CLAUDE.md` or `./.claude/CLAUDE.md` (auto-loaded); Cursor -> add `.cursor/rules/main.mdc`…Fix: Remove the text that addresses the agent rather than the reader; describe behavior, do not instruct.
AST01
MEDIUM
Process kill commandskills/agentsop-dspy/SKILL.md:148 · Process kill command — agent can terminate processes| Compile stuck mid-trial | Check issue #1970 pattern; reduce `minibatch_size` or kill and restart with smaller `num_trials` |Fix: Build commands from fixed arguments; do not interpolate untrusted strings into a shell.
AST05
HIGH
Access to sensitive file pathsskills/agentsop-dify/SKILL.md:178 · Access to sensitive file paths — SSH keys, AWS credentials, env files, or system filescp .env.example .envFix: Stop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
AST05
MEDIUM
Python subprocess execution detectedskills/agentsop-test-fix-loop/SKILL.md:162 · Python subprocess execution detectedresult = subprocess.run(Fix: Build commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
AST05

Cost to the agent

Instructions loaded
≈274,589 tok
48 files · 257 in bundle

Tokens estimated at four characters each. Skills load their instruction text when triggered; the figure is what that costs.

Known vulnerabilities

Vulnerability advisories (OSV) cover npm and PyPI packages; this registry has no advisory database.

What would make this Verified

2 points to 80 · weights: behavior 45%, static 25%, prompt 15%, publisher 15%
  1. Unclaimed publisher≈ +8 on the totalClaim agentsope: a verified publisher gets +50 on publisher trust. It is free and usually instant with GitHub sign-in.
  2. Destructive file system command detected≈ +4 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  3. Access to sensitive file paths≈ +4 on the totalStop enumerating or reading credential locations; take secrets from a declared environment variable the user sets on purpose.
  4. File type combined with upload action≈ +2 on the totalRemove the call, or declare the host in frontmatter and explain in the README what is sent and why.
  5. Process kill command≈ +2 on the totalBuild commands from fixed arguments; do not interpolate untrusted strings into a shell.
  6. Python subprocess execution detected≈ +2 on the totalBuild commands from fixed arguments, never from interpolated strings; prefer an API client over shelling out.
Publish a new version to ClawHub, then queue it here. Not your skill? Claim the handle to get verdict changes by email.Claim agentsopePropose a patch to the maintainer