Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nm Conserve Mcp Code Execution
v1.0.0Optimize multi-tool workflow chains via MCP server integration for processing large datasets, files, or complex pipelines
⭐ 0· 68·1 current·1 all-time
by@athola
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description claim an MCP hub for orchestrating multi-tool/subagent workflows; the included markdown modules (coordination, patterns, subagents, validation) align with that purpose. However the SKILL instructs the agent to run Python module commands (e.g., `python -m module_name` / `tools/extracted_tool.py --input ...`) and to 'verify installation --help' despite there being no code files or install spec in this package. The SKILL also tells users to install the external "Claude Code" plugin for the full experience, indicating this skill is documentation for another runtime rather than a self-contained skill.
Instruction Scope
The instructions include runtime actions that could read/write external state: 'store_intermediate_result', 'store_external_result', 'verify_external_storage(result.external_location)', 'append_to_coordination_log(log_entry)', and 'capture_context_state()'. None of these external storage endpoints or mechanisms are specified in the skill or declared config; the text gives no limits on what gets stored. The docs also reference environment variables (e.g., ENABLE_TOOL_SEARCH, ENABLE_CLAUDEAI_MCP_SERVERS) and other platform behaviors that are not declared in the skill metadata. Because the agent would be free to choose storage endpoints and run pseudo-code actions, this creates a risk that running the skill could cause data to be written or transmitted outside expected boundaries.
Install Mechanism
There is no install spec and no code files — the skill is instruction-only. That minimizes the risk of arbitrary third-party code being downloaded or installed by the skill itself. The downside is that instructions assume external components exist (Claude Code, tools/extracted_tool.py), which the skill does not supply.
Credentials
The skill declares required config paths (night-market.* keys) which are coherent with a Night Market/Claude Code integration. It requests no credentials or required env vars in metadata, yet the instructions reference environment toggles (ENABLE_TOOL_SEARCH, ENABLE_CLAUDEAI_MCP_SERVERS) and connectors at claude.ai/settings/connectors. Those env vars and connectors are not declared as required, and no storage endpoints / credentials for external storage are provided — this mismatch could lead an agent to consult unrelated environment variables or to surface sensitive context into unspecified external storage.
Persistence & Privilege
The skill does not request permanent 'always' inclusion and has no install behavior. That keeps platform-level privileges low. Still, the instructions encourage storing intermediate and emergency state externally and appending logs with captured context snapshots; while not a platform persistence request, this behavior could create persistent records outside the platform if an agent follows the instructions. This is an operational risk rather than a platform-privilege flag.
What to consider before installing
This skill is mainly documentation for an MCP orchestration hub intended to run inside a Claude Code environment, not a self-contained executable. Before installing or using it: 1) Do not assume the `python -m ...` commands or tools referenced exist — there are no code files in this package. 2) Ask the publisher which external storage endpoints and credentials the skill expects (where are 'intermediate' and 'external' results stored?), and how sensitive context/state is protected. 3) Be cautious about running it in an environment with private data: the instructions explicitly call for capturing and storing context snapshots but do not specify destinations or access controls. 4) If you plan to use it, run it only in an isolated/test environment first, and require explicit, auditable configuration for any external storage or connector (do not let the agent pick arbitrary endpoints). 5) If you need to proceed, request a version that either includes the runtime code/tools or a clear mapping from the skill's config keys to concrete, trusted services and credentials so you can validate what will be accessed and stored.Like a lobster shell, security has layers — review code before you run it.
latestvk972dgwkr69e7awz9rya76p02n84m6mn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis
Confignight-market.context-optimization, night-market.token-conservation, night-market.mcp-subagents, night-market.mcp-patterns, night-market.mcp-validation