Geekbench
v1.0.1Provides real-time searches and verified Geekbench scores for the latest officially released flagship smartphones by brand.
⭐ 0· 518·2 current·2 all-time
byd404@dingqing404
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (fetch verified Geekbench scores) aligns with the presence of a crawler, monitor, and archived data. However, the skill metadata claims 'instruction-only' / no install spec and lists no required binaries while shipping three substantial Python scripts (geekbench_crawler.py, monitor.py, tasks.py). That is inconsistent: bundled code implies the need for a runtime (Python) and network access but those requirements are not declared.
Instruction Scope
SKILL.md correctly instructs the agent to perform live web searches and verify Geekbench results; it does not request reading local secrets or unrelated files. The runtime instructions are narrowly scoped to search/verify tasks. However, the shipped monitor/crawler code and archived reports indicate automated scraping/monitoring behavior not documented in SKILL.md — the agent’s instructions and the included automation artifacts are not fully reconciled.
Install Mechanism
No install spec is provided (lower install risk), but code files are included and marked for execution. There is no declaration of how to run them (no required binaries listed, no Python requirement). This mismatch increases risk because bundled scripts could be executed in the agent environment without the user knowing required runtime, dependencies, or network behavior.
Credentials
The skill requests no environment variables or credentials (proportionate for a public data scraper). That is good. Still, because the code is present but not documented, there's no guarantee the code won't attempt to read environment variables or local files at runtime — the metadata doesn't declare any such accesses, so a code review is needed to confirm proportionality.
Persistence & Privilege
always:false and model invocation not disabled (defaults). The skill does not request permanent/system-level presence. There is no evidence it modifies other skills or agent-wide settings in the provided artifacts.
What to consider before installing
This skill appears to deliver what it promises (geekbench scraping and monitoring), but there are red flags you should address before installing: (1) Review the three bundled Python files (geekbench_crawler.py, monitor.py, tasks.py) to confirm they only access expected endpoints (e.g., browser.geekbench.com and search engines) and do not POST data to unknown servers or read local secrets. (2) Ask the publisher for the source repository or homepage and for a clear runtime/install/permission list (Python version, required packages). (3) If you must run it, execute it in a sandboxed environment and inspect outgoing network connections. (4) Prefer skills that explicitly declare required binaries/dependencies and a verifiable source; if you cannot audit the code, treat this skill as higher risk.Like a lobster shell, security has layers — review code before you run it.
latestvk978mwbcqyvdm98er1j1yrz9898181hn
License
MIT-0
Free to use, modify, and redistribute. No attribution required.