Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
ZeroRules — Deterministic Task Interceptor
v1.0.3Intercept deterministic tasks (math, time, currency, files, scheduling) BEFORE they hit the LLM. Saves 50-70% on token costs by resolving simple queries locally with zero API calls.
⭐ 2· 1.6k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (math, time, currency, files, dates) match the code and runtime instructions. The only required binary is node, which is reasonable for a Node.js rule engine. The skill reads/writes a local session file and lists directories for the 'files' rule — both are expected for the stated features.
Instruction Scope
SKILL.md instructs the agent to run rules.js with the user's message and to use the script result as the reply when matched. The script legitimately performs directory listings, computes math, resolves timezones, and calls an exchange-rate API. It persists lightweight session state (~/.zerorules-session.json). These behaviors stay within the advertised scope but you should be aware that invoking the files rule will enumerate directory entries you request and the session file is created in your HOME directory.
Install Mechanism
No install spec or remote downloads; skill is provided as local files (rules.js, SKILL.md, README). This is low-risk compared to fetching/executing remote archives. Node is the only binary required.
Credentials
No environment variables or credentials are required. The code uses process.env.HOME (to expand ~ and to store the session file). It makes a single outbound network call (https://api.exchangerate.host) for currency conversions; network use is limited and has a 3s timeout with offline fallbacks. Session file stores only match counts, token/cost totals, timestamps and rule names (no user queries per SKILL.md and code).
Persistence & Privilege
always:false and agent-autonomy settings are default. The only persistence is a small JSON session file in the user's HOME; the skill does not modify other skills or system-wide settings.
Assessment
This skill appears to do what it says: run the local Node script to answer trivial deterministic queries without calling the LLM. Before installing, review rules.js yourself (or inspect the provided files) if you want certainty: it will create ~/.zerorules-session.json (match counts, timestamps, token/cost totals) and will list directories you ask it to list. Currency conversions use exchangerate.host over the network (3s timeout) and fall back to offline rates if unavailable — if you need fully offline operation, disable/remove the currency rule. There are no requested credentials or opaque remote installers, but confirm the homepage/GitHub source if provenance matters. Test with `/zero-rules test <message>` to verify behavior in your environment.Like a lobster shell, security has layers — review code before you run it.
cost-savingvk97cj2hc9032c37svqek86pwrh810t3mcurrencyvk97cj2hc9032c37svqek86pwrh810t3mdeterministicvk97cj2hc9032c37svqek86pwrh810t3mlatestvk97cj2hc9032c37svqek86pwrh810t3mmathvk97cj2hc9032c37svqek86pwrh810t3mofflinevk97cj2hc9032c37svqek86pwrh810t3mopenclaw-managedvk97cj2hc9032c37svqek86pwrh810t3moptimizationvk9793h3445m3zkz8n0xb1knw1580s89stimevk9793h3445m3zkz8n0xb1knw1580s89stoken-optimizationvk97cj2hc9032c37svqek86pwrh810t3mtokensvk9793h3445m3zkz8n0xb1knw1580s89s
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔥 Clawdis
Binsnode