Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nm Egregore Summon

v1.0.0

Autonomous orchestrator processing manifest work items through the development lifecycle with budget tracking

0· 37·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
!
Purpose & Capability
The skill claims to orchestrate a dev pipeline and delegates work to other Night Market skills; the required config paths align with that purpose. However the SKILL.md instructs use of git, the GitHub CLI (gh), and python3 scripts but the registry metadata lists no required binaries—this is an incoherence: an orchestrator that manipulates branches, creates PRs, and merges needs git/GH tooling available and authenticated.
!
Instruction Scope
Runtime instructions read/write .egregore/manifest.json, budget.json, continuation.json and may create branches, run `gh issue view`, execute `python3 scripts/deferred_capture.py`, call `notify.py`, invoke Skill(...) for other skills, and perform prepare-pr/merge steps. These actions go beyond read-only analysis and can modify repo state and trigger external notifications. The orchestrator also recommends staying in-foreground and scheduling CronCreate resume prompts, which affect session lifecycle. All of this is coherent for an orchestrator but has significant side effects and depends on local scripts whose behavior is not declared.
Install Mechanism
Instruction-only skill with no install spec or extracted downloads. This lowers supply-chain risk because nothing is written by an installer. However the runtime still expects local CLIs and scripts to exist.
!
Credentials
The skill declares no required environment variables or primary credential, yet the instructions implicitly require authenticated access to GitHub (via `gh` or equivalent) and may rely on notification channels configured for `notify.py`. It can perform operations (creating branches, PRs, merges, pushing) that typically require tokens/credentials; those credentials are neither declared nor scoped here, which is an inconsistency and a potential security risk.
Persistence & Privilege
The skill does not request always:true and is not force-enabled. It writes and persists orchestration state under `.egregore/*` (expected), and can schedule CronCreate resume prompts. It can make durable changes to a repository (branches, PRs, merges) if the environment and tools are present — this is powerful but consistent with an automated orchestrator; users should be aware of the potential for autonomous repo changes.
What to consider before installing
This orchestrator appears to do what it says, but several mismatches and powerful side-effects mean you should not install it blindly. Before using it: - Verify prerequisites are present and explicit: ensure git, gh (GitHub CLI) and python3 are on PATH and authenticated as you intend. The skill expects these but doesn't declare them. - Review repository-local scripts referenced (scripts/deferred_capture.py, scripts/parallel.py, notify.py, manifest.py, prepare-pr logic). These run at runtime and may send network requests or push commits/PRs. - Check auto_merge and merge policy in the egregore config. If auto_merge:true is enabled, the skill may merge PRs without human review—disable or require manual steps if you want control. - Confirm notification behavior: inspect notify.py and any configured channels to understand what external systems are informed when rate limits or failures occur. Provide minimal-scope credentials and tokens only. - Run in a controlled environment first: try on a sandbox repo or with pipeline/auto-merge disabled and manual invocation to observe behavior. Back up important branches before allowing autonomous runs. - Limit agent autonomy if possible: run manually (not scheduled/autonomous) until you’ve validated its behavior, and monitor logs (.egregore/manifest.json, budget.json, continuation.json). If you can inspect the referenced scripts and provide explicit, least-privilege credentials for any external service the skill must use (and disable auto-merge), the remaining concerns become manageable. If you cannot inspect those files or do not want automated repo writes/notifications, treat this skill as unsuitable.

Like a lobster shell, security has layers — review code before you run it.

latestvk97cwpaf3jb1nrj4wkce4pe8c184p2kh

License

MIT-0
Free to use, modify, and redistribute. No attribution required.

Runtime requirements

🦞 Clawdis
Confignight-market.attune:project-brainstorming, night-market.attune:project-specification, night-market.attune:project-planning, night-market.attune:project-execution, night-market.pensive:code-refinement, night-market.conserve:bloat-detector, night-market.sanctum:pr-prep, night-market.sanctum:pr-review, night-market.sanctum:commit-messages, night-market.conserve:clear-context

Comments