Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nm Conserve Cpu Gpu Performance
v1.0.0Establish CPU/GPU baselines before resource-intensive operations. Use for regression detection
⭐ 0· 57·1 current·1 all-time
by@athola
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description match the instructions: steps to capture utilization, profiling, throttling, and logging. However, the registry metadata declares a required config path (night-market.token-conservation) which is not referenced or justified by the instructions. A CPU/GPU baseline helper normally wouldn't need an external token/config; this is an inconsistency that should be explained by the author (integration with Night Market may be the reason).
Instruction Scope
SKILL.md only instructs local monitoring and profiling commands (uptime, ps, nvidia-smi, perf, nsys, etc.), scoping is limited to establishing baselines and managing resource usage. It does not instruct reading unrelated files, exfiltrating data, or calling external endpoints.
Install Mechanism
Instruction-only skill with no install spec and no code files — lowest-risk installation surface. Nothing is downloaded or written to disk by an installer.
Credentials
No env vars or binaries are required, but the single required config path (night-market.token-conservation) is potentially sensitive. The SKILL.md does not show any use of that config, so requesting it appears disproportionate to the stated purpose unless the skill integrates with a Night Market service. This should be justified: what is stored at that path, and why is it needed?
Persistence & Privilege
always is false and the skill is user-invocable; it does not request permanent presence or system-wide changes. The SKILL.md mentions auto-loading alongside token-conservation in usage guidance, but that is a usage suggestion, not an enforced persistent privilege.
What to consider before installing
The skill's instructions for benchmarking and throttling CPU/GPU usage look reasonable and limited to local monitoring. Before installing, ask the publisher to explain why the skill requires the 'night-market.token-conservation' config path: what data or token is stored there, and how the skill uses it? If that config contains sensitive tokens, review the Night Market plugin code (or avoid installing) to ensure the skill won't read or transmit secrets. Also verify that the host has the profilers/commands it references (nvidia-smi, perf, nsys) and that you are comfortable granting the skill autonomous invocation in case it gets invoked by other Night Market automation.Like a lobster shell, security has layers — review code before you run it.
latestvk97avm6mvrbnyxbsg6rmvh02h584nrza
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis
Confignight-market.token-conservation