ClawHub

Profit

v2.0.1

Reference tool for devtools — covers intro, quickstart, patterns and more. Quick lookup for Profit concepts, best practices, and implementation patterns.

⭐ 0· 122·0 current·0 all-time
by@bytesagain1
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (reference docs for Profit/devtools) align with the included files: SKILL.md describes plain-text commands and scripts/script.sh implements those commands. There are no extra binaries, env vars, or unrelated requirements. Minor inconsistency: repository metadata/version is 2.0.1 while the script's VERSION is 2.0.0 and the help heredoc is single-quoted (so $VERSION will not expand) — this is a benign housekeeping mismatch.
✓
Instruction Scope
SKILL.md instructs producing heredoc text only; the runtime script only outputs static documentation via heredocs and uses no network, file reads, or secret access. The script does not collect or transmit user data or reference system credentials.
✓
Install Mechanism
There is no install spec (instruction-only skill). One shell script is bundled; it is not downloaded from an external URL nor does it perform installs. No archives are extracted and nothing writes to unexpected system locations.
✓
Credentials
The skill declares no required environment variables, no credentials, and the implementation does not read environment variables or config paths. Requested privileges are minimal and proportionate to a local reference tool.
✓
Persistence & Privilege
always is false and the skill does not request persistent/system-wide configuration or modify other skills. Autonomous invocation is permitted (platform default) but the skill's scope is limited to printing docs.
Assessment
This skill appears safe and does what it says: prints static reference text. If you want extra caution, review scripts/script.sh locally (already provided) and run it in a sandbox or container before allowing autonomous agent invocation. Note the small version string mismatch in the script (2.0.0) vs registry (2.0.1) — harmless but worth fixing. If you require strict assurance, ensure the agent cannot run arbitrary shell commands outside this skill or enable the skill only for trusted agents.

Like a lobster shell, security has layers — review code before you run it.

latestvk97212na613f4p5j6rkwe09q8983hn0y

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments