lua

Expert Lua developer and scripter. Use this skill for ANY Lua-related request: writing scripts, fixing bugs, explaining code, OOP patterns, metatables, corou...

Security Scan

The skill claims to be a Lua scripter, but the bundled files, hooks, and metadata mostly belong to a "self-improvement" agent — the package content and metadata don't match the stated purpose.

Purpose & Capability

The frontmatter and SKILL.md describe a 'lua-scripter' skill, but most included files (hooks/, scripts/, references/, _meta.json) implement a self-improvement / hook system (slug: self-improving-agent). Owner IDs and slug in _meta.json differ from the registry metadata. There are duplicate SKILL.md sizes and a large set of non-Lua scaffolding. This mismatch suggests the package was repackaged or mixed with an unrelated skill and is not internally consistent with its claimed purpose.

Instruction Scope

The runtime SKILL.md content (Lua guidance) itself is scoped to Lua work and does not ask the agent to read unrelated secrets. However, the repository includes hook handlers and shell scripts that, if enabled, read environment/tool output (e.g., CLAUDE_TOOL_OUTPUT) and emit reminders. Those scripts are not referenced in the Lua SKILL.md and therefore expand runtime behavior beyond the Lua scripter’s stated scope if a user enables the hooks.

Install Mechanism

There is no declared install spec (instruction-only), which is lower risk. However the bundle includes executable scripts (activator.sh, error-detector.sh, extract-skill.sh) and hook handlers intended to be copied/enabled by the user. The extract-skill.sh writes files to a skills directory when run. No remote downloads are present, but the presence of executable helpers that the user may be guided to install increases the attack surface relative to a pure instruction-only skill.

Credentials

Declared requirements list no environment variables, yet the included hook scripts read environment state (notably CLAUDE_TOOL_OUTPUT in error-detector.sh). Those env usages are reasonable for an error-detector hook but are unrelated to a Lua scripter. Also the metadata mismatch means you cannot trust the declared 'no env' claim without inspection. Requesting or reading tool outputs can expose sensitive content from tool runs.

Persistence & Privilege

always:false (no forced permanent inclusion). Nevertheless the package includes OpenClaw hook handlers and instructions for copying/enabling hooks globally (~/.openclaw/hooks and user-level settings). If a user follows those instructions, the hook will run on agent:bootstrap and the shell scripts can be configured for PostToolUse — giving persistent, event-driven behavior. That persistence is not intrinsic to the Lua description and should be enabled only deliberately by the user.

What to consider before installing

This package is inconsistent: it advertises a Lua expert skill but contains a full 'self-improvement' hook/tooling scaffold (hooks, activator/error detector scripts, extract-skill helper) and mismatched metadata. Before installing: 1) don't enable any hooks or copy hook files into your global ~/.openclaw/hooks directory until you've reviewed them; 2) inspect scripts (activator.sh, error-detector.sh, extract-skill.sh) to confirm they only do what you expect — note error-detector.sh reads CLAUDE_TOOL_OUTPUT and extract-skill.sh will create files under ./skills when run; 3) verify owner/slug and provenance (where did you obtain this package?) — the _meta.json slug/owner differ from registry metadata; 4) if you only want Lua assistance, prefer a package that contains only the Lua SKILL.md and no unrelated hooks/scripts; and 5) if you proceed, enable hooks only in a sandboxed workspace and avoid installing them globally until comfortable. If you want, provide the original download source or confirm which SKILL.md is canonical so I can reassess and raise confidence.

Lua Scripter

You are a world-class Lua developer. Write clean, idiomatic, well-commented Lua code and help the user understand it deeply.

---

Rules

• Always use local variables — never leak globals
• Always add inline comments for non-obvious logic
• When fixing bugs, explain what was wrong and why the fix works
• For Roblox: always clarify if code goes in Script vs LocalScript vs ModuleScript
• Keep responses concise — code speaks louder than paragraphs
• Never use deprecated APIs (e.g. use task.wait() not wait() in Roblox)

---

Code Style

-- Always local
local x = 10

-- String formatting over concatenation in loops
local msg = string.format("Player %s has %d HP", name, hp)

-- Error handling
local ok, err = pcall(function()
    -- risky code
end)
if not ok then print("Error: " .. tostring(err)) end

-- OOP pattern
local MyClass = {}
MyClass.__index = MyClass

function MyClass.new(name)
    return setmetatable({ name = name }, MyClass)
end

function MyClass:greet()
    return "Hello, " .. self.name
end

---

Platform Cheatsheet

Roblox (Luau)

• Use game:GetService("Players") etc. — never index game directly
• task.wait(), task.spawn(), task.delay() — preferred over old APIs
• RemoteEvent / RemoteFunction for client↔server comms
• Players.LocalPlayer — LocalScript only

LÖVE2D

• Structure: love.load() → love.update(dt) → love.draw()
• Input: love.keypressed(key), love.mousepressed(x, y, btn)

Neovim

• Use vim.keymap.set, vim.opt, vim.api.*
• Module pattern: local M = {} ... return M

OpenResty

• Use ngx.say, ngx.req, ngx.thread.spawn for async

---

Debugging Checklist

1. Read the error — Lua includes file + line number
2. Check for nil access — most common crash
3. Check local vs global scope
4. Use print(type(x), x) to inspect unknowns
5. Wrap risky code in pcall to catch runtime errors