Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nm Sanctum Tutorial Updates

v1.0.0

Generate tutorials from VHS tapes and Playwright specs with dual-tone markdown and GIF recording

0· 113·1 current·1 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for athola/nm-sanctum-tutorial-updates.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Nm Sanctum Tutorial Updates" (athola/nm-sanctum-tutorial-updates) from ClawHub.
Skill page: https://clawhub.ai/athola/nm-sanctum-tutorial-updates
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Config paths to check: night-market.sanctum:shared, night-market.sanctum:git-workspace-review, night-market.scry:vhs-recording, night-market.scry:browser-recording, night-market.scry:gif-generation, night-market.scry:media-composition
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install nm-sanctum-tutorial-updates

ClawHub CLI

Package manager switcher

npx clawhub@latest install nm-sanctum-tutorial-updates
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
medium confidence
Purpose & Capability
Name/description (tutorial generation, VHS/Playwright recordings, GIFs, dual‑tone markdown) match the SKILL.md and included modules. The declared config paths (night-market.sanctum/scry entries) are consistent with orchestrating local recording and media composition; no unrelated cloud credentials or unrelated binaries are requested.
Instruction Scope
The SKILL.md explicitly instructs the agent to scan the repository, parse manifests/tape files, run validation, run binaries (e.g., 'vhs', 'skrills', Playwright specs), possibly start background processes from manifest 'requires', and rebuild local binaries with cargo. All of these are within the stated purpose, but they involve executing commands extracted from tape files and running local build/serve processes. That means the agent will run arbitrary local commands referenced in tapes/manifests — review those inputs and avoid running on sensitive hosts.
Install Mechanism
Instruction-only skill (no install spec, no external downloads). Nothing is written to disk by the skill bundle itself. The SKILL.md recommends running local tooling (cargo install) but this is invoked by the agent/environment, not delivered by the skill package.
Credentials
No required environment variables or external API credentials are declared. The only requested configuration items are internal Night Market config paths related to recording/generation. The skill does read git repo metadata and file system paths (manifests, tape files); this is expected for its purpose. Note: tape files can include Env directives (e.g., SKRILLS_SKILL_DIR) which the skill reads to verify demo data — review tapes before execution.
Persistence & Privilege
Skill is not always:true, is user-invocable, and allows model invocation (the platform default). It does not request persistent system-wide privileges or modify other skills' configs. It may start background processes as part of recording (expected for Playwright/serve workflows), so be cautious about ports/services started on the host.
Assessment
This skill appears internally consistent with its purpose, but it executes repository commands and may rebuild/run local binaries. Before installing or running: (1) review .manifest.yaml and .tape files to ensure they don't contain destructive or sensitive commands, (2) run validation (--validate-only or --scaffold) first, (3) run in an isolated environment or container (not on a machine with sensitive data), and (4) be prepared that 'cargo install', 'vhs', Playwright specs, and background services may build code and open local ports. If you cannot review the tape/manifest contents, treat the operations as untrusted and use a disposable CI or VM.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🦞 Clawdis
Confignight-market.sanctum:shared, night-market.sanctum:git-workspace-review, night-market.scry:vhs-recording, night-market.scry:browser-recording, night-market.scry:gif-generation, night-market.scry:media-composition
latestvk97bn6g47jvjb0eyx1th4de9pn856z0d
113downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

Night Market Skill — ported from claude-night-market/sanctum. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Table of Contents

Tutorial Updates Skill

Orchestrate tutorial generation with GIF recordings from VHS tape files and Playwright browser specs.

When To Use

  • Generating or updating user-facing tutorials
  • Creating VHS and Playwright tutorial recordings

When NOT To Use

  • Internal documentation without user-facing tutorials
  • API reference docs - use scribe:doc-generator instead

Overview

This skill coordinates the complete tutorial generation pipeline:

  1. Discover tape files and manifests in the project
  2. Validate tape commands and check binary freshness
  3. Rebuild binaries if stale so demos reflect latest code
  4. Record terminal sessions using VHS (scry:vhs-recording)
  5. Record browser sessions using Playwright (scry:browser-recording)
  6. Generate optimized GIFs (scry:gif-generation)
  7. Compose multi-component tutorials (scry:media-composition)
  8. Generate dual-tone markdown for docs/ and book/

Command Options

/update-tutorial quickstart        # Single tutorial by name
/update-tutorial sync mcp          # Multiple tutorials
/update-tutorial --all             # All tutorials with manifests
/update-tutorial --list            # Show available tutorials
/update-tutorial --scaffold        # Create structure without recording

Verification: Run the command with --help flag to verify availability.

Required TodoWrite Items

Create todos with these prefixes for progress tracking:

**Verification:** Run the command with `--help` flag to verify availability.
- tutorial-updates:discovery
- tutorial-updates:validation
- tutorial-updates:rebuild
- tutorial-updates:recording
- tutorial-updates:generation
- tutorial-updates:integration

Verification: Run the command with --help flag to verify availability.

Phase 1: Discovery (tutorial-updates:discovery)

Step 1.1: Locate Tutorial Assets

Find tape files and manifests in the project:

# Find manifest files
find . -name "*.manifest.yaml" -type f \
  -not -path "*/.venv/*" -not -path "*/__pycache__/*" \
  -not -path "*/node_modules/*" -not -path "*/.git/*" \
  2>/dev/null | head -20

# Find tape files
find . -name "*.tape" -type f \
  -not -path "*/.venv/*" -not -path "*/__pycache__/*" \
  -not -path "*/node_modules/*" -not -path "*/.git/*" \
  2>/dev/null | head -20

# Find browser specs
find . -name "*.spec.ts" -path "*/browser/*" -type f \
  -not -path "*/.venv/*" -not -path "*/__pycache__/*" \
  -not -path "*/node_modules/*" -not -path "*/.git/*" \
  2>/dev/null | head -20

Verification: Run the command with --help flag to verify availability.

Step 1.2: Parse Manifests

For each manifest file, extract:

  • Tutorial name and title
  • Component list (tape files, playwright specs)
  • Output paths for GIFs
  • Composition rules (layout, combine options)

See modules/manifest-parsing.md for manifest schema details.

Step 1.3: Handle Options

OptionBehavior
--listDisplay discovered tutorials and exit
--allProcess all discovered manifests
--scaffoldCreate directory structure and empty files without recording
<names>Process only specified tutorials

When --list is specified:

**Verification:** Run the command with `--help` flag to verify availability.
Available tutorials:
  quickstart     assets/tapes/quickstart.tape
  sync           assets/tapes/sync.tape (manifest)
  mcp            assets/tapes/mcp.manifest.yaml (terminal + browser)
  skill-debug    assets/tapes/skill-debug.tape

Verification: Run the command with --help flag to verify availability.

Phase 1.5: Validation (tutorial-updates:validation)

CRITICAL: Validate tape commands BEFORE running VHS to avoid expensive regeneration cycles.

See modules/tape-validation.md for detailed validation logic.

Step 1.5.1: VHS Syntax Validation

Check each tape file for valid VHS syntax:

# Required: Output directive exists
grep -q '^Output ' "$tape_file" || echo "ERROR: Missing Output directive"

# Check for balanced quotes in Type directives
grep '^Type ' "$tape_file" | while read -r line; do
  quote_count=$(echo "$line" | tr -cd '"' | wc -c)
  if [ $((quote_count % 2)) -ne 0 ]; then
    echo "ERROR: Unbalanced quotes: $line"
  fi
done

Verification: Run the command with --help flag to verify availability.

Step 1.5.2: Extract and Validate CLI Commands

For each Type directive, extract the command and validate flags:

# Extract commands from Type directives
grep '^Type ' "$tape_file" | sed 's/^Type "//' | sed 's/"$//' | while read -r cmd; do
  # Skip comments, clear, and echo commands
  [[ "$cmd" =~ ^# ]] && continue
  [[ "$cmd" == "clear" ]] && continue

  # For skrills commands, validate flags exist
  if [[ "$cmd" =~ ^skrills ]]; then
    base_cmd=$(echo "$cmd" | awk '{print $1, $2}')
    flags=$(echo "$cmd" | grep -oE '\-\-[a-zA-Z0-9-]+' || true)

    for flag in $flags; do
      if ! $base_cmd --help 2>&1 | grep -q -- "$flag"; then
        echo "ERROR: Invalid flag '$flag' in command: $cmd"
      fi
    done
  fi
done

Verification: Run the command with --help flag to verify availability.

Step 1.5.3: Verify Demo Data Exists

If the tape uses demo data, verify it exists and is populated:

# Check SKRILLS_SKILL_DIR if set
skill_dir=$(grep '^Env SKRILLS_SKILL_DIR' "$tape_file" | sed 's/.*"\(.*\)"/\1/')
if [ -n "$skill_dir" ]; then
  if [ ! -d "$skill_dir" ]; then
    echo "ERROR: Demo skill directory missing: $skill_dir"
  else
    skill_count=$(find "$skill_dir" -name "SKILL.md" 2>/dev/null | wc -l)
    if [ "$skill_count" -eq 0 ]; then
      echo "ERROR: No skills in demo directory: $skill_dir"
    else
      echo "OK: Found $skill_count demo skills in $skill_dir"
    fi
  fi
fi

Verification: Run the command with --help flag to verify availability.

Step 1.5.4: Test Commands Locally

CRITICAL: Run each extracted command locally to verify it produces expected output:

# For each command in the tape, do a quick sanity check
# This catches issues like:
# - Commands that exit with non-zero status
# - Commands that produce no output (won't show anything in GIF)
# - Commands that require user input (will hang VHS)

for cmd in $(extract_commands "$tape_file"); do
  # Run with timeout to catch hanging commands
  if ! timeout 5s bash -c "$cmd" &>/dev/null; then
    echo "WARNING: Command may fail or hang: $cmd"
  fi
done

Verification: Run the command with --help flag to verify availability.

Validation Flags

FlagBehavior
--validate-onlyRun validation without generating GIF
--skip-validationBypass validation for rapid regeneration

Validation Exit Criteria

  • VHS tape syntax is valid (Output directive, balanced quotes)
  • All CLI flags in commands are valid (verified against --help)
  • Demo data directories exist and are populated
  • Commands execute successfully with expected output

If validation fails: Stop immediately, report errors, and do NOT proceed to VHS recording.

Phase 1.6: Binary Rebuild (tutorial-updates:rebuild)

CRITICAL: Ensure the binary being tested in tapes matches the latest source code. Stale binaries produce misleading demos.

Step 1.6.1: Detect Build System

Identify the project's build system:

# Check for Cargo (Rust)
if [ -f "Cargo.toml" ]; then
  BUILD_SYSTEM="cargo"
  BINARY_NAME=$(grep '^name = ' Cargo.toml | head -1 | sed 's/.*"\(.*\)"/\1/')
  echo "Detected Cargo project: $BINARY_NAME"
# Check for Makefile
elif [ -f "Makefile" ]; then
  BUILD_SYSTEM="make"
  echo "Detected Make project"
# Unknown
else
  echo "WARNING: Unknown build system, skipping binary check"
  BUILD_SYSTEM="unknown"
fi

Verification: Run make --dry-run to verify build configuration.

Step 1.6.2: Check Binary Freshness

Compare binary modification time against Git HEAD:

check_binary_freshness() {
  local binary_name="$1"

  # Locate binary (check cargo install location first, then PATH)
  local binary_path=$(which "$binary_name" 2>/dev/null)

  if [ -z "$binary_path" ]; then
    echo "WARNING: Binary '$binary_name' not found in PATH"
    return 1
  fi

  # Get binary modification time (Linux/macOS compatible)
  local binary_mtime
  if command -v stat >/dev/null 2>&1; then
    # Linux
    binary_mtime=$(stat -c %Y "$binary_path" 2>/dev/null || \
    # macOS
    stat -f %m "$binary_path" 2>/dev/null)
  else
    echo "WARNING: stat command not available, skipping freshness check"
    return 2
  fi

  # Get Git HEAD commit time
  local git_head_time=$(git log -1 --format=%ct 2>/dev/null)

  if [ -z "$git_head_time" ]; then
    echo "WARNING: Not a git repository, skipping freshness check"
    return 2
  fi

  # Compare timestamps
  if [ "$binary_mtime" -lt "$git_head_time" ]; then
    echo "STALE: Binary is older than Git HEAD"
    echo "  Binary: $(date -d @$binary_mtime 2>/dev/null || date -r $binary_mtime)"
    echo "  HEAD:   $(date -d @$git_head_time 2>/dev/null || date -r $git_head_time)"
    return 1
  else
    echo "OK: Binary is up-to-date"
    return 0
  fi
}

Verification: Run git status to confirm working tree state.

Step 1.6.3: Rebuild Binary

Rebuild using the detected build system:

rebuild_binary() {
  local build_system="$1"
  local binary_name="$2"

  case "$build_system" in
    cargo)
      echo "Rebuilding with Cargo..."
      # Use cargo install for CLI binaries
      if [ -d "crates/cli" ]; then
        cargo install --path crates/cli --locked --quiet
      else
        cargo install --path . --locked --quiet
      fi
      ;;
    make)
      echo "Rebuilding with Make..."
      make build --quiet
      ;;
    *)
      echo "ERROR: Cannot rebuild, unknown build system"
      return 1
      ;;
  esac

  echo "Build complete: $binary_name"
}

Verification: Run make --dry-run to verify build configuration.

Step 1.6.4: Verify Binary Accessibility

Ensure the rebuilt binary is accessible:

verify_binary() {
  local binary_name="$1"

  if ! command -v "$binary_name" >/dev/null 2>&1; then
    echo "ERROR: Binary '$binary_name' not found after rebuild"
    echo "  Check PATH includes: $HOME/.cargo/bin"
    return 1
  fi

  # Test binary can execute
  if ! "$binary_name" --version >/dev/null 2>&1; then
    echo "WARNING: Binary exists but --version failed"
  else
    echo "OK: Binary is accessible and functional"
    "$binary_name" --version
  fi
}

Verification: Run pytest -v to verify tests pass.

Rebuild Flags

FlagBehavior
--skip-rebuildSkip binary freshness check and rebuild
--force-rebuildForce rebuild even if binary is fresh

Rebuild Exit Criteria

  • Build system detected (Cargo, Make, or explicitly skipped)
  • Binary freshness checked against Git HEAD
  • Binary rebuilt if stale (or forced)
  • Rebuilt binary is accessible in PATH
  • Binary executes successfully (--version test)

If rebuild fails: Stop immediately, report build errors, and do NOT proceed to tape validation or VHS recording.

Phase 2: Recording (tutorial-updates:recording)

Step 2.1: Process Tape Components

For each tape file component:

  1. Parse tape file for metadata annotations (@step, @docs-brief, @book-detail)
  2. Validate Output directive exists
  3. Invoke Skill(scry:vhs-recording) with tape file path
  4. Verify GIF output was created

Step 2.2: Process Browser Components

For each playwright spec component:

  1. Check requires field for prerequisite commands (e.g., start server)
  2. Launch any required background processes
  3. Invoke Skill(scry:browser-recording) with spec path
  4. Stop background processes
  5. Invoke Skill(scry:gif-generation) to convert WebM to GIF

Step 2.3: Handle Multi-Component Tutorials

For manifests with combine section:

  1. Verify all component GIFs exist
  2. Invoke Skill(scry:media-composition) with manifest
  3. Verify combined output was created

Phase 3: Generation (tutorial-updates:generation)

Step 3.1: Parse Tape Annotations

Extract documentation content from tape files:

# @step Install skrills
# @docs-brief Install via cargo
# @book-detail The recommended installation method uses cargo...
Type "cargo install skrills"

Verification: Run the command with --help flag to verify availability.

Annotations:

  • @step - Step title/heading
  • @docs-brief - Concise text for project docs (docs/ directory)
  • @book-detail - Extended text for technical book (book/ directory)

Step 3.2: Generate Dual-Tone Markdown

Generate two versions of each tutorial:

  1. Project docs (docs/tutorials/<name>.md)

    • Brief, action-oriented
    • Uses @docs-brief content
    • Focuses on commands and quick results
  2. Technical book (book/src/tutorials/<name>.md)

    • Detailed, educational
    • Uses @book-detail content
    • Explains concepts and rationale

See modules/markdown-generation.md for formatting details.

Step 3.3: Generate README Demo Section

Create or update demo section in README.md:

## Demos

### Quickstart
![Quickstart demo](assets/gifs/quickstart.gif)
*Install, validate, analyze, and serve in under a minute. [Full tutorial](docs/tutorials/quickstart.md)*

Verification: Run the command with --help flag to verify availability.

Phase 4: Integration (tutorial-updates:integration)

Step 4.1: Verify All Outputs

Confirm all expected files exist:

# Check GIF files
for gif in assets/gifs/*.gif; do
  if [[ -f "$gif" ]]; then
    echo "OK: $gif ($(du -h "$gif" | cut -f1))"
  else
    echo "MISSING: $gif"
  fi
done

# Check markdown files
ls -la docs/tutorials/*.md 2>/dev/null
ls -la book/src/tutorials/*.md 2>/dev/null

Verification: Run the command with --help flag to verify availability.

Step 4.2: Update SUMMARY.md (Book)

If the project has an mdBook structure, update book/src/SUMMARY.md:

- [Tutorials](./tutorials/README.md)
  - [Quickstart](./tutorials/quickstart.md)
  - [Sync Workflow](./tutorials/sync.md)
  - [MCP Integration](./tutorials/mcp.md)
  - [Skill Debugging](./tutorials/skill-debug.md)

Verification: Run the command with --help flag to verify availability.

Step 4.3: Report Results

Summarize the update:

**Verification:** Run the command with `--help` flag to verify availability.
Tutorial Update Complete
========================
Tutorials processed: 4
GIFs generated: 5
  - quickstart.gif (1.2MB)
  - sync.gif (980KB)
  - mcp-terminal.gif (1.5MB)
  - mcp-browser.gif (2.1MB)
  - skill-debug.gif (890KB)

Markdown generated:
  - docs/tutorials/ (4 files)
  - book/src/tutorials/ (4 files)

README demo section updated

Verification: Run the command with --help flag to verify availability.

Exit Criteria

  • All specified tutorials processed (or all if --all)
  • GIF files created at manifest-specified paths
  • Dual-tone markdown generated for each tutorial
  • README demo section updated with GIF embeds
  • Book SUMMARY.md updated (if applicable)
  • All TodoWrite items completed

Error Handling

ErrorResolution
VHS not installedgo install github.com/charmbracelet/vhs@latest
Playwright not installednpm install -D @playwright/test && npx playwright install chromium
Tape file missing OutputAdd Output assets/gifs/<name>.gif directive
Browser spec requires serverStart server before running spec
GIF too largeAdjust fps/scale in gif-generation

Scaffold Mode

When --scaffold is specified, create structure without recording:

  1. Create assets/tapes/ directory
  2. Create assets/gifs/ directory
  3. Create assets/browser/ directory (if browser tutorials planned)
  4. Create template tape file with metadata annotations
  5. Create template manifest file
  6. Create empty markdown files in docs/tutorials/ and book/src/tutorials/

Template tape file:

# @title: Tutorial Name
# @description: Brief description of the tutorial

Output assets/gifs/tutorial-name.gif
Set FontSize 14
Set Width 1200
Set Height 600
Set Theme "Catppuccin Mocha"

# @step Step 1 Title
# @docs-brief Brief docs text
# @book-detail Extended book text with more context and explanation
Type "command here"
Enter
Sleep 2s

Verification: Run the command with --help flag to verify availability.

Troubleshooting

Common Issues

Command not found Ensure all dependencies are installed and in PATH

Permission errors Check file permissions and run with appropriate privileges

Unexpected behavior Enable verbose logging with --verbose flag

Comments

Loading comments...