Crunch Compete

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for Crunch competition work and discloses its package installs, token use, and submission workflow.

This skill appears safe to install for Crunch competition work. Before using it, be ready to create an isolated Python virtual environment, install trusted PyPI packages, provide a Crunch token only when needed, keep the `.crunch/` config private, and explicitly review any final `crunch push` submission.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If you ask it to submit, it may send your competition solution to CrunchDAO.

Why it was flagged

The skill can guide the agent to submit a Crunch competition entry through the CLI. This is a meaningful external action, but it is disclosed and directly aligned with the skill's stated purpose.

Skill content
`submit my solution` | `crunch push`
Recommendation

Review the solution and submission message before allowing `crunch push`, and use `crunch push --dry` first if you want a dry run.

What this means

Anyone with access to the project directory may be able to use the stored Crunch token for that project.

Why it was flagged

The skill requires a user-provided Crunch submission token and explains that the CLI persists it locally for later authenticated commands.

Skill content
After setup, the CLI stores the token in the project's `.crunch/` config directory.
Recommendation

Provide tokens only when needed, keep project directories private, and avoid committing or sharing the `.crunch/` directory.

What this means

Installing packages can execute third-party code in the virtual environment.

Why it was flagged

The skill instructs installing unpinned packages from PyPI. It mitigates this by requiring a virtual environment and disallowing custom package indexes, but package installs still carry normal dependency risk.

Skill content
pip install crunch-cli jupyter ipykernel --upgrade --quiet --progress-bar=off
Recommendation

Use the virtual environment as instructed, install only packages you trust, and review competition-specific package recommendations before approving them.