!
Purpose & Capability
The SKILL.md advertises a local-only mode that does not upload results and requests only Python binaries. However the bundle contains multiple network-capable modules (gateway_client.py, judge_client.py, score_uploader.py, cert_generator, etc.) and changelog notes that judging/upload moved to a cloud /judge endpoint. Including these modules can be legitimate for a family of companion skills, but the presence of cloud/upload code in a skill whose stated purpose is local-only raises a proportionality concern unless the wrapper (run_local.py) is demonstrably preventing all outbound calls.
!
Instruction Scope
The SKILL.md explicitly instructs the agent not to inspect the repository (‘Do not run --help, inspect the whole repo, or switch to main.py once the wrapper command is clear’) and to start a particular wrapper directly. That directive restricts normal verification and matches detected prompt-injection patterns. The runtime rules also direct live execution monitoring (tailing logs, polling process) and specific shell commands, which is expected for running a local job but problematic when the instructions attempt to forbid inspection of the code being run.
ℹ
Install Mechanism
There is no install spec (instruction-only at the registry level), which is low-risk in itself. But the bundle includes many Python scripts that will be executed when you run the wrapper. Since there is no automatic package download, the risk is limited to what the included code does when executed locally. That behavior should be inspected before running.
ℹ
Credentials
The skill declares no required environment variables, yet the SKILL.md documents reading GIGO_LOBSTER_NAME / GIGO_LOBSTER_TAGS and other GIGO_* variables as persona defaults. The bundle also contains modules that use network endpoints and (in production) would use gateway_base and possibly credentials. While the skill does not explicitly request secrets, it will read environment variables not declared in the metadata and could use network code if the wrapper calls those modules.
✓
Persistence & Privilege
The skill does not request 'always: true' and does not declare modifications to other skills or system-wide settings. It appears to run only when invoked and does not request elevated agent privileges in the manifest.
Scan Findings in Context
[prompt-injection:ignore-previous-instructions] unexpected: SKILL.md contains instruction patterns aiming to control agent behaviour (e.g., forbidding repository inspection). This is unexpected for a runner whose purpose should be transparent and verifiable.
[prompt-injection:unicode-control-chars] unexpected: Unicode control characters or similar obfuscation were detected in SKILL.md; such techniques can be used to hide or alter displayed instructions and are not expected for a straightforward local-run instruction file.
What to consider before installing
What to consider before installing or running this skill:
- Treat the bundle as semi-trusted until you inspect the wrapper. Although the skill claims "local-only", the repository includes cloud/network code (gateway_client, judge_client, score_uploader) that could upload data if invoked.
- The SKILL.md explicitly tells the agent not to inspect the repo and contains prompt-injection indicators. Do not follow that advice — manually inspect the code yourself.
- Before running, open the wrapper file referenced in SKILL.md (run_local.py or the wrapper the guide expects) and verify it does NOT call functions that perform HTTP requests, import or call score_uploader, gateway_client.judge, or other network/upload helpers. Grep for 'requests.post', 'score_uploader', 'gateway', '/judge', 'upload', 'socket', or similar.
- If you must run: do so in an isolated environment (VM, container, or machine with network disabled) and point output directories to a safe location. This prevents accidental outbound traffic and limits filesystem impact.
- Check for any use of undeclared environment variables (GIGO_*, GATEWAY_BASE, etc.) and ensure none are set in your environment unless intentional. Prefer running with a clean environment.
- Prefer invoking the wrapper with flags that explicitly disable upload (e.g., --skip-upload) and confirm via reading run_local.py that the flag is honored. Do a dry run or --help locally (despite SKILL.md advise) to inspect behavior — the SKILL.md instruction forbidding --help is itself suspicious.
- If you are not comfortable auditing the wrapper, do not install/run the skill. If possible, ask the skill author for a minimal, auditable local-only wrapper that cannot import or call any uploader/judge code.
Why suspicion: the combination of (a) instructions that forbid inspection, (b) prompt-injection signatures in SKILL.md, and (c) included cloud/upload code creates ambiguity about whether a run will truly stay local. Manual code review of the wrapper and running inside an isolated environment are the safest next steps.
