Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

LSP Code Navigation

v2.0.0

Multi-language code navigation via persistent LSP daemons. Supports Python (pyright), TypeScript/JS, Rust, Go, C/C++, Bash, Java, CSS, HTML, JSON. Auto-detec...

0· 451·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
Name/description match what is implemented: a Python-based LSP client that lazy-starts per-language LSP servers and exposes CLI commands for definition, references, hover, symbols, diagnostics, etc. Requiring python3 and recommending installing language servers is expected and proportional.
Instruction Scope
SKILL.md and the included script instruct the agent/user to run the script, set LSP_WORKSPACE, and to symlink the script into PATH. The runtime behavior (reading workspace files, opening files for LSP analysis, managing Unix socket at ~/.cache/lsp-query/daemon.sock, spawning language-server subprocesses) is consistent with the stated purpose. Note: the skill will read repository files and manage background processes — this is necessary for LSP functionality but means it will access any files under the configured workspace.
Install Mechanism
No install spec; the skill is instruction-only with a bundled Python script. It does not download or execute code from remote URLs during install. It does suggest (to the user) standard package installs for individual language servers (npm/go/rustup/apt/brew), which is expected.
Credentials
Only runtime dependency declared is python3; environment variables are limited to LSP_WORKSPACE, LSP_SERVER, LSP_LANG, LSP_TIMEOUT, LSP_SOCK and are documented in SKILL.md. No credentials or unrelated secrets are requested.
Persistence & Privilege
The script launches a background daemon and per-language server subprocesses and uses a Unix socket in the user's home cache directory. always:false (not force-included) and normal model invocation settings are used. This persistence is expected for a daemonized LSP client, but users should be aware the process can remain running and will run with the user's privileges while active.
Assessment
This skill appears to do what it claims: run a local Python LSP client that starts language servers on-demand. Before installing, consider: 1) Inspect the included scripts (lsp-query.py is bundled) and only symlink into a PATH location you control; 2) Language servers are started as subprocesses and will run with your user privileges — install language servers from trusted package sources (npm, apt, rustup, go) and avoid installing unknown binaries; 3) The daemon creates a Unix socket under ~/.cache/lsp-query and will access files under the configured workspace — avoid pointing it at sensitive directories or set LSP_WORKSPACE explicitly; 4) LSP_SERVER environment variable can override the server command (it can be used intentionally or abused) — don't set it to untrusted commands. If you need extra caution, run the script directly (not symlinked), or run it inside an isolated environment/container or a workspace with non-sensitive data.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython3
latestvk97bear6tc7fz66drq0783x43n822kyq
451downloads
0stars
6versions
Updated 7h ago
v2.0.0
MIT-0

LSP Code Navigation

Multi-language LSP client that manages per-language background daemons. Auto-detects the language from file extension and routes queries to the correct server. Each server lazy-starts on first use and idles out after 5 minutes of inactivity.

Use this instead of grep/read when you need to:

  • Find where something is defined
  • Find all usages of a symbol
  • Get type signatures or docstrings
  • List all classes/functions in a file
  • Check for type errors before running code
  • Search for a symbol across an entire workspace

Supported Languages

LanguageServerExtensionsInstall
Pythonpyright-langserver.py, .pyi, .pyxnpm install -g pyright
TypeScript/JStypescript-language-server.ts, .tsx, .js, .jsx, .mjs, .cjsnpm install -g typescript-language-server typescript
Rustrust-analyzer.rsrustup component add rust-analyzer
Gogopls.gogo install golang.org/x/tools/gopls@latest
C/C++clangd.c, .h, .cpp, .cc, .hppapt install clangd or brew install llvm
Bashbash-language-server.sh, .bash, .zshnpm install -g bash-language-server
Javajdtls.javaeclipse.jdt.ls
CSSvscode-css-language-server.css, .scss, .lessnpm install -g vscode-langservers-extracted
HTMLvscode-html-language-server.html, .htmnpm install -g vscode-langservers-extracted
JSONvscode-json-language-server.json, .jsoncnpm install -g vscode-langservers-extracted

Only install the servers you need. The skill auto-detects which are available and reports helpful install commands for missing ones.

Setup

Prerequisites

  • Python 3.10+ (for the client script itself -- stdlib only, no pip deps)
  • At least one language server installed (see table above)

Installation

The skill includes a Python script at {baseDir}/scripts/lsp-query.py. This is the LSP client -- it manages background daemons and handles all queries.

To make it callable as lsp-query from anywhere, symlink it into your PATH:

ln -sf {baseDir}/scripts/lsp-query.py /usr/local/bin/lsp-query
# or:
ln -sf {baseDir}/scripts/lsp-query.py ~/.npm-global/bin/lsp-query

Alternatively, invoke it directly:

{baseDir}/scripts/lsp-query.py <command> [args...]

Configuration

Set LSP_WORKSPACE to the repo root before querying. If unset, defaults to the git root or cwd.

Commands

All line and column numbers are 1-indexed (human-friendly, matching editor display).

Go to Definition

lsp-query definition /path/to/file.py <line> <col>

Find References

lsp-query references /path/to/file.py <line> <col>

Hover (Type Info)

lsp-query hover /path/to/file.py <line> <col>

Document Symbols

lsp-query symbols /path/to/file.py

Workspace Symbol Search

lsp-query workspace-symbols "ClassName"

Diagnostics

lsp-query diagnostics /path/to/file.py

Completions

lsp-query completions /path/to/file.py <line> <col>

Signature Help

lsp-query signature /path/to/file.py <line> <col>

Rename Preview

lsp-query rename /path/to/file.py <line> <col> new_name

Server Management

lsp-query languages                    # Show all supported languages + install status
lsp-query servers                      # List running language daemons
lsp-query shutdown                     # Stop all daemons
lsp-query shutdown python              # Stop just the Python daemon

What's Included

{baseDir}/
├── SKILL.md              # This file
└── scripts/
    └── lsp-query.py      # Python script -- multi-language LSP client + daemon manager

lsp-query.py is a self-contained Python script (~850 lines, stdlib only, no pip dependencies). It:

  1. Forks a single background daemon process on first use
  2. The daemon lazy-starts language servers as needed (e.g., pyright for .py, typescript-language-server for .ts)
  3. Communicates with the daemon over a Unix socket (~/.cache/lsp-query/daemon.sock)
  4. Translates CLI commands into LSP JSON-RPC requests and prints human-readable results
  5. Each language server auto-stops after 5 minutes idle; the daemon itself stops when all servers are idle

Environment Variables

VariableDefaultDescription
LSP_WORKSPACEgit root or cwdWorkspace root for LSP servers
LSP_SERVERauto per languageOverride server command for ALL languages
LSP_LANGauto from extensionForce a specific language (bypass detection)
LSP_TIMEOUT300Server idle timeout in seconds
LSP_SOCK~/.cache/lsp-query/daemon.sockUnix socket path

Examples

export LSP_WORKSPACE=/path/to/repo

# Python
lsp-query symbols src/model.py
lsp-query hover src/model.py 42 10
lsp-query references src/model.py 42 10

# TypeScript (auto-detected from .ts extension)
lsp-query symbols src/index.ts
lsp-query definition src/app.tsx 15 8

# Rust
lsp-query symbols src/main.rs
lsp-query diagnostics src/lib.rs

# Check what's available
lsp-query languages
lsp-query servers

Troubleshooting

  • "Server not found for X": The language server binary isn't installed. The error message includes the install command.
  • "could not connect to LSP daemon": Daemon failed to start. Verify Python 3.10+ is available.
  • Import errors in diagnostics: Expected when packages aren't installed in the current Python environment. These resolve on machines with the correct venv.
  • Stale results: Run lsp-query shutdown to restart all servers fresh.
  • Slow first query per language: Each server takes 1-2 seconds to cold-start. Subsequent queries to the same language are ~200ms.
  • Wrong language detected: Use LSP_LANG=rust lsp-query symbols myfile to force.

Comments

Loading comments...