quantum-sim

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This appears to be a coherent local quantum circuit simulator with no artifact-backed credential, network, or persistence behavior, but it runs a bundled Python script and large qubit counts may strain system resources.

This skill looks suitable for local quantum-circuit experiments. Before installing, be comfortable with running the bundled Python script, and avoid very large qubit counts unless you are prepared for high CPU or memory use.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Invoking the skill may run the included Python script on the user's machine to perform simulations.

Why it was flagged

The skill is intended to work by running a bundled Python simulator. This local code execution is clearly disclosed and directly aligned with the quantum-simulation purpose.

Skill content
python3 {baseDir}/scripts/quantum_sim.py --preset bell
Recommendation

Use it when local script execution is acceptable; review or restrict execution if you have strict local-code policies.

What this means

Large simulations, especially near the advertised 20-qubit limit, may hang or exhaust local memory.

Why it was flagged

The visible single-qubit gate implementation builds a full operator matrix before applying it. For high qubit counts, this can use far more CPU and memory than users may expect from a simple statevector simulator.

Skill content
for i in range(n-1, -1, -1):
                if i == qubit:
                    op = np.kron(op, np.array(gate_mat, dtype=complex))
...
            self.state = op @ self.state
Recommendation

Start with small qubit counts and avoid unattended large runs; the skill author should document practical limits or use an in-place statevector update implementation.