Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Kai Master Builder
v1.0.1Developer, Code, Engineer. Guide the Agent to build apps/features/goals efficiently and securely. Creates project plans, task lists, and provides building pr...
⭐ 0· 76·0 current·0 all-time
byBlaze🔥@ogdegenblaze
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill is an instruction-only 'builder' that creates plans, tasks, and run/test prompts — python3 is a reasonable required binary. However, the runtime instructions reference commands/tools not declared as required (e.g., npm, pytest, pip, doc build commands). The presence of those references without declaring them is an inconsistency (minor but notable).
Instruction Scope
The SKILL.md tells the agent to pick tasks, implement code, run validation commands (python3 test_x.py, pytest, pip list, npm list, doc builds) and update project files. Those actions will execute code and modify files in the user's workspace. While expected for a builder skill, the instructions also explicitly encourage autonomous operation (cron / sessions_spawn). Executing arbitrary build/test commands can access the network, installed packages, or system resources — the skill gives broad discretion to run such commands without guardrails.
Install Mechanism
No install spec or code is included (instruction-only). That minimizes supply-chain risk because nothing is downloaded or written by an installer.
Credentials
The skill requests no environment variables or credentials, and its security checklist discourages hardcoding secrets. That is proportionate. Still, because it runs arbitrary build/test commands, it could read local environment or files if the agent is instructed to do so — the SKILL.md does not enumerate or limit which environment variables or paths the agent may access.
Persistence & Privilege
The skill itself is not always-enabled (always: false) and has no install persistence. However, the SKILL.md explicitly recommends setting up cron or using sessions_spawn to run autonomously. Scheduling this skill to run unattended increases risk because it may execute build/test steps and modify files without an explicit human review.
What to consider before installing
This skill appears to do what it says (plan tasks and run build/test steps), but exercise caution before using it unattended. Things to consider before installing or scheduling it: 1) Run it in an isolated workspace or container (so tests/builds can't touch your system or secrets). 2) Review any generated/modified code and commits before pushing them. 3) Ensure you understand and restrict what validation commands will run (pytest, npm, pip, doc builds) and install only the tools you trust. 4) Do not grant access to sensitive environment variables or credentials; the skill doesn't need any declared secrets, but build scripts might. 5) Because provenance is unknown (no homepage/source), prefer running it interactively first and require manual approval before enabling cron/automation. If the owner/source is provided and the SKILL.md is updated to list all required binaries and explicit safety guardrails, my confidence would increase.Like a lobster shell, security has layers — review code before you run it.
automationvk97802xnhkmnj79jhcn91zf1eh838r6fbuildervk97ee687sr4tkk2remsvrknafn839w3ecodevk97ee687sr4tkk2remsvrknafn839w3edevelopervk97ee687sr4tkk2remsvrknafn839w3eengineervk97ee687sr4tkk2remsvrknafn839w3ekaivk97ee687sr4tkk2remsvrknafn839w3elatestvk97ee687sr4tkk2remsvrknafn839w3eprojectvk97802xnhkmnj79jhcn91zf1eh838r6f
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
Binspython3