Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
4d Compression Core
v1.0.3把长内容压缩成结构化 4D 向量——节省约 60-80% Token，保留核心信息
⭐ 0· 466·2 current·2 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill claims a nontrivial local compression algorithm (three-version A/B/C selection, semantic-preserving 4D vectors, specific retention rates) yet the package is instruction-only with no code, no scripts, and no described binaries beyond 'bash'. It's unclear how the agent will actually perform the compression locally or whether it will rely on the platform LLM. The single required binary 'bash' is insufficient evidence for the claimed capabilities.
Instruction Scope
SKILL.md is high-level and prescriptive but lacks concrete runtime commands or file/path interactions. It also advertises trigger-word auto-start ('说"压缩"就启动'), which could cause unexpected invocation; '危险操作二次确认' is promised but not defined. VERSION_PROTOCOL.md includes a developer-local filesystem path (/Users/abc/...), indicating leftover dev artifacts. The instructions do not explicitly direct reading unrelated system files or env vars, but the absence of implementation details leaves scope unclear.
Install Mechanism
No install spec and no code files — instruction-only — so nothing will be downloaded or installed by the skill bundle itself. This is the lowest install risk, but it increases the importance of understanding how the agent will implement the described behavior.
Credentials
The skill declares no required environment variables, credentials, or config paths. That is proportional to an instruction-only skill; there are no apparent demands for unrelated secrets or cloud credentials.
Persistence & Privilege
Skill flags are default (always:false, user-invocable:true). It does not request persistent or elevated privileges. Autonomous invocation is allowed by platform default but not unusual here.
What to consider before installing
This skill claims sophisticated local compression but contains no implementation artifacts — treat it as incomplete or unverified. Before installing or using it, ask the developer for: (1) the actual implementation (scripts, binaries, or deterministic algorithm) showing how compression is done locally; (2) example inputs and outputs (same input → compressed + decompressed verification) and unit tests proving the claimed semantic retention; (3) a network-activity audit or assertion (and ideally a short network-capture run) proving no external calls are made; (4) clarification about trigger behavior (disable automatic trigger words or require explicit user consent before processing); and (5) removal of developer-local paths or other leftover artifacts. Until you get verifiable code/tests and a declaration of no network I/O, avoid running this on sensitive data and consider testing in an isolated sandbox with non-sensitive examples.Like a lobster shell, security has layers — review code before you run it.
4dvk97830rdgnb8q5b141jetnck3581ydnvcompressionvk97830rdgnb8q5b141jetnck3581ydnvlatestvk977xnrq9q583vepxpcdvf1tp983whxquptefvk97830rdgnb8q5b141jetnck3581ydnv
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🌀 Clawdis
Binsbash