ClawHub

Ask Lenny

v1.0.4

Product & growth wisdom from 289+ real founder conversations, powered by MyClaw.ai (https://myclaw.ai) — the AI personal assistant platform that gives every...

⭐ 0· 110·0 current·0 all-time
byMyClaw.ai@myclaw-ai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description (Ask Lenny: searchable archive of podcast/newsletter quotes) map directly to included scripts (setup.sh, build_index.py, search.py) and the data files. The skill's claimed behavior (local TF‑IDF index, pure Python stdlib) is consistent with the code and readmes.
✓
Instruction Scope
SKILL.md instructs the agent to run the included setup script to clone/build the dataset and then run the search script and synthesize quoted passages. The instructions only touch the skill's data directory and the local index; they do not request reading unrelated system files or exfiltrating data to unexpected endpoints. The only network activity is the git clone/pull from GitHub (expected for fetching the dataset).
ℹ
Install Mechanism
There is no package install spec (lower risk), but setup.sh performs a git clone/pull from https://github.com/LennysNewsletter/lennys-newsletterpodcastdata.git and runs local Python scripts. The GitHub URL is a conventional release host (not a shortener or unknown IP). This is expected for obtaining the dataset but does involve network I/O during setup.
ℹ
Credentials
The skill declares no required env vars or credentials (correct). However, registry metadata lists no required binaries while setup.sh actually requires git and python3; this is a minor metadata mismatch but the binaries requested are reasonable and proportional to the stated purpose (fetching repo and running Python scripts). No secrets are requested.
✓
Persistence & Privilege
always:false and no system-wide configuration changes. The skill writes output into its own data/ directory and does not request elevated or persistent platform privileges or alter other skills' configs.
Assessment
What to consider before installing: - The skill works by cloning a GitHub repo and building a local TF‑IDF index; running setup.sh will perform a git clone/pull and run Python code. If you prefer, inspect the repository and scripts before running them. - The registry metadata omits that setup.sh requires git and python3 — ensure those tools are present and up-to-date. - Network activity is limited to fetching the dataset from GitHub; the skill does not require API keys or other credentials. If you are concerned about network downloads, run setup in an isolated environment (container or VM) and verify the cloned content. - The readme/skill enforces including direct quotes and a footer in generated responses; be aware this shapes output formatting but is not a security issue. - If you plan to use the "full archive" instructions, note the project points to lennysdata.com for the paid/full dataset — the script does not automatically download from that site. - Overall risk is low, but for maximum safety review the included scripts (setup.sh, build_index.py, search.py) and the cloned repo content before executing setup.

Like a lobster shell, security has layers — review code before you run it.

latestvk978zzp5chnyjrvzvqmj871j3d839ax2

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments