Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Nm Gauntlet Extract
v1.0.0Analyze a codebase and build a knowledge base of business logic, architecture, data flow, and engineering patterns. The foundation for gauntlet challenges an...
⭐ 0· 49·1 current·1 all-time
by@athola
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description match the instructions: the skill is an instruction-only extractor that analyzes a codebase and writes .gauntlet/knowledge.json. That capability aligns with its stated purpose.
Instruction Scope
Instructions require running: python3 ${CLAUDE_PLUGIN_ROOT}/scripts/extractor.py <target-dir> and read/write .gauntlet/knowledge.json and .gauntlet/annotations/. The use of CLAUDE_PLUGIN_ROOT is not declared anywhere and grants the agent a file-system path it will use; the instructions also default to the current working directory (which may permit reading arbitrary repo files). These are functional for the stated goal but the undeclared env var and broad filesystem access are concerning and should be validated.
Install Mechanism
There is no install spec and no code files included (instruction-only). That minimizes install-time risk because nothing is downloaded or written by an installer.
Credentials
The skill declares no required env vars, yet the runtime instructions reference CLAUDE_PLUGIN_ROOT (an environment variable) and implicitly require python3. The mismatch (undeclared CLAUDE_PLUGIN_ROOT and an undeclared required binary) is disproportionate and could lead to unexpected path usage or failures.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request persistent platform privileges or to modify other skills. Its write scope is local (.gauntlet/knowledge.json), which is expected for its purpose.
What to consider before installing
This skill is instruction-only and appears to do what it says (scan a repo and build .gauntlet/knowledge.json), but check two things before installing or running it: (1) ensure CLAUDE_PLUGIN_ROOT is set to a safe path you control (the SKILL.md references ${CLAUDE_PLUGIN_ROOT}/scripts/extractor.py but the skill did not declare that env var), and (2) ensure python3 and the extractor script actually exist and are trustworthy. Because the instructions operate on the current working directory, run it on a copy or in an isolated environment if you have sensitive files in the repo. If possible, open and review scripts/extractor.py in the referenced plugin repo to confirm what it reads/transmits before giving it access to your codebase.Like a lobster shell, security has layers — review code before you run it.
latestvk971dckz3bntd3z53d4505xnd584qmft
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🦞 Clawdis