Clawhub Skill

Scaffold a personal LLM wiki (Karpathy pattern) — multi-agent, MCP-ready, with SEO/GEO publish target. Compiles knowledge into a persistent wiki instead of r...

Security Scan

The skill is coherent with its stated purpose (it scaffolds a wiki by invoking an npm package), but it instructs the agent to download and execute remote code (npx/npm) that is not included in the skill bundle and makes unverifiable privacy/telemetry claims — this mismatch warrants caution.

Purpose & Capability

The name/description (scaffold a personal LLM wiki) matches the instructions: the SKILL.md explicitly wraps an npm package create-opc-wiki and provides commands to scaffold a vault, run an MCP server, and build a static site. Required capabilities (filesystem access, running shell commands, optional npm installs) are consistent with the claimed functionality.

Instruction Scope

The instructions tell the agent to run shell commands (npx -y create-opc-wiki@latest <path> and later npm install/npm start in generated subdirs). This is within the scope of scaffolding a project, but it does cause the agent to fetch and execute third-party code at runtime. The SKILL.md also asserts privacy guarantees (lines referencing mcp/server.mjs:38 and site/build.mjs:53) even though the skill bundle contains no code to verify those claims — the guarantees are unverified assertions about external package code.

Install Mechanism

There is no install spec in the skill bundle; instead the runtime instructions invoke npx to pull create-opc-wiki@latest from npm. Fetching and executing an npm package at runtime is a moderate-to-high risk pattern because arbitrary code will be downloaded and run locally. While npm is a well-known registry (less risky than random URLs), the actual package contents are not included in the skill and were not scanned here, so behavior and telemetry cannot be audited from this bundle.

Credentials

The skill declares no required environment variables, credentials, or config paths. That aligns with the stated purpose; nothing in SKILL.md asks the agent to read unrelated secrets. The lack of requested credentials is a positive sign.

Persistence & Privilege

always is false and the skill is user-invocable (normal). The skill does not request persistent platform-level privileges or modify other skills. Note: the agent is allowed to invoke the skill autonomously by platform defaults, but that is not unique to this skill and is not by itself flagged here.

What to consider before installing

This skill instructs the agent to run npx to download and execute the create-opc-wiki npm package and to run npm install/start in generated directories. That is coherent with scaffolding a wiki, but you should verify the external package before running it: review the npm package and GitHub repo (https://www.npmjs.com/package/create-opc-wiki and https://github.com/MackDing/create-opc-wiki), inspect mcp/server.mjs and site/build.mjs to confirm the claimed privacy gates, and prefer pinning to a specific version rather than using @latest. Run the scaffolder in an isolated environment (non-root, container, or VM) if you cannot audit the code fully. If you need higher assurance, request the skill author include the package source or a checksum in the skill bundle so the code can be audited prior to execution. Finally, avoid granting additional credentials or mounting secrets into the target path unless necessary.

create-opc-wiki

Scaffold a personal LLM wiki on the Karpathy pattern in 30 seconds. Multi-agent native, MCP server built-in, SEO/GEO-optimized publish target.

What this skill does

Run the scaffolder against any folder and you get a complete personal-knowledge-base vault:

• agent-rules/main.md — single source of truth, synced to 9 agent file formats (CLAUDE.md, AGENTS.md, .cursor/rules/main.mdc, .cursorrules, .github/copilot-instructions.md, .trae/rules.md, .openclaw/rules.md, .hermes/agent.md)
• Three reusable skills: /wiki-ingest, /wiki-query, /wiki-lint
• Five source recipes: arXiv paper, X thread, YouTube transcript, RSS article, podcast transcript
• Privacy-tagged frontmatter: public | private | secret
• An MCP server with three tools (wiki_query, wiki_list, wiki_read) and a hard privacy gate (privacy: secret pages never leave the box)
• Optional Astro static site target with sitemap.xml, llms.txt, robots.txt, RSS feed, OpenGraph + JSON-LD per page

How to invoke

The skill wraps the published npm package create-opc-wiki@latest. From any agent that can run a shell command:

npx -y create-opc-wiki@latest <path> --yes --agents=openclaw,claude,codex,cursor

Common one-liners:

Agent	Command
OpenClaw	npx -y create-opc-wiki@latest ~/wiki --yes --agents=openclaw,claude
Claude Code	npx -y create-opc-wiki@latest ~/wiki --yes --agents=claude
Codex CLI	npx -y create-opc-wiki@latest ~/wiki --yes --agents=codex
Cursor	npx -y create-opc-wiki@latest ~/wiki --yes --agents=cursor
All of them	npx -y create-opc-wiki@latest ~/wiki --yes --agents=openclaw,claude,codex,cursor,hermes,vscode,trae

Add --no-mcp, --no-site, --no-recipes, or --no-git to skip those layers. --json emits machine-readable result on stdout.

How to use the generated vault

1. Open the folder in Obsidian (it's a valid Obsidian vault) — and/or
2. Open the folder in your AI agent (it reads CLAUDE.md / AGENTS.md / .openclaw/rules.md / etc.)
3. From inside the agent, use the three skills:
   • /wiki-ingest <url-or-file> — drop a new source, agent files it into raw/ and synthesizes wiki pages
   • /wiki-query <question> — natural-language query across compiled wiki
   • /wiki-lint — health-check (contradictions, stale speculative claims, orphan pages)

The MCP server in mcp/server.mjs exposes the wiki to any MCP client (Claude Desktop, Cursor, Codex). Run npm install && npm start from the mcp/ directory.

Why a wiki and not just RAG

Most LLM-on-files setups re-derive answers from raw docs at every query. There's no accumulation. Quoting Karpathy's gist:

The LLM incrementally builds and maintains a persistent wiki — a structured, interlinked collection of markdown files that sits between you and the raw sources. The wiki keeps getting richer with every source you add and every question you ask.

This skill operationalizes exactly that, with concrete choices for ontology, agent rules, MCP, and publishing.

Privacy & security

• privacy: secret pages never returned by the MCP server (enforced at mcp/server.mjs:38)
• privacy: public is the only level that publishes (enforced at site/build.mjs:53)
• Default frontmatter privacy is private — nothing publishes by accident
• The scaffolder runs once, locally, and exits — no telemetry, no network calls during scaffolding except the optional npm install you trigger yourself

Links

• npm: https://www.npmjs.com/package/create-opc-wiki
• GitHub: https://github.com/MackDing/create-opc-wiki
• Inspiration: https://gist.github.com/karpathy/442a6bf555914893e9891c11519de94f
• Stability scope: see STABILITY.md in the repo for the semver-stable surface
• Per-agent install recipes: see docs/INSTALL-FOR-AGENTS.md in the repo

License

MIT. Inspired by Andrej Karpathy's "LLM Wiki" gist; implementation choices are this project's. Full attribution in INSPIRATION.md.