ℹ
Purpose & Capability
The SKILL.md and triggers describe a local-only benchmark runner and the declared runtime requirements are minimal (python3). That aligns with the 'local' purpose. However, the shipped bundle contains many cloud/network-related modules (gateway_client.py, judge_client.py, score_uploader.py, session_client.py, etc.) and a full evaluation harness designed to call a /judge endpoint. Those files are coherent with the broader 'gigo-lobster' family (there are upload/register modes), but they are not strictly necessary for a single local-run skill and therefore are worth noticing.
!
Instruction Scope
The SKILL.md gives precise runtime instructions to run the wrapper (e.g. python3 /absolute/path/to/run_local.py) and to tail a log under ~/.openclaw/workspace/outputs/gigo-lobster-local/gigo-run.log — these are within the local-run scope. However, the SKILL.md also contains pre-scan prompt-injection markers (e.g. 'ignore-previous-instructions' and unicode-control-chars were detected). That suggests parts of the runtime instructions may be trying to influence agent behavior beyond normal scope. Additionally, the manifest includes code that performs network calls (requests.post in judge_client/gateway_client). While the instructions discourage uploads, the presence of code that can contact external endpoints increases the risk if the wrapper or other scripts are invoked with different flags or if a bug lets that code run.
ℹ
Install Mechanism
There is no install script (instruction-only install spec), which reduces install-time risk. However, the skill package contains a large bundle of code files that will be present on disk when the skill is installed. No external download URLs or extract-from-URL steps are declared. The inclusion of many files is unusual for a small local runner but not inherently dangerous — it just increases the attack surface if any of those files are executed.
ℹ
Credentials
The skill declares no required environment variables or credentials and requires only a Python binary — reasonable for a local runner. SKILL.md does reference optional local env vars (GIGO_LOBSTER_NAME, GIGO_LOBSTER_TAGS, GIGO_UPLOAD_MODE) and reading SOUL.md; those are proportionate. That said, some bundled modules (judge_client/gateway_client/score_uploader) would typically require endpoint configuration (gateway_base) or credentials but those are not declared as required — meaning network-capable code is present but not explicitly requested.
✓
Persistence & Privilege
The skill is not marked always:true and does not request persistent privileges. There is no install-time autorun or declared modification of system-wide configs. The instruction to tail logs and keep the process attached does not imply elevated privileges. Overall persistence/privilege level appears normal.
Scan Findings in Context
[prompt-injection:ignore-previous-instructions] unexpected: The SKILL.md contains text patterns that the pre-scan flagged as 'ignore-previous-instructions' — this is a prompt-injection style pattern that could try to override agent instruction flow. For a local-run wrapper this is not expected and should be treated as suspicious.
[prompt-injection:unicode-control-chars] unexpected: The SKILL.md contained unicode control character patterns that the scanner flagged. These are often used to obfuscate instructions or hide injected directives; not expected for a straightforward runtime instruction file.
[network-calls:requests_post] expected: Multiple bundled files (e.g., bundle/harness_reference/judge_client.py and bundle/INTEGRATION.md references) perform HTTP POSTs to a /judge gateway. This is expected for the overall gigo-lobster family (upload/judge modes), but not for a strictly local-only run. Presence is therefore expected for the family but not required for local mode.
What to consider before installing
This skill claims 'local-only' behavior and its SKILL.md enforces running the provided local wrapper, which is good. Still, the package includes many files that can perform network calls (judge_client, gateway_client, score_uploader). Before installing or running:
- Inspect the wrapper: open run_local.py (and the small wrapper scripts referenced, e.g., run_local.py / run_register.py) and confirm they do not invoke network functions or import judge_client/gateway_client.
- Grep for 'requests.post', 'gateway', 'judge', 'score_uploader' in the bundle to see what code can reach out. If you find network calls, read the surrounding code to confirm they are not executed in the local wrapper path.
- Prefer running the skill in an isolated environment (VM/container) or with network disabled for the first run to verify behavior and outputs (lobster-report.*, lobster-cert.*, gigo-run.log).
- Check the gigo-run.log for unexpected outgoing connections or errors. If you see attempts to POST to external URLs, stop the run.
- Because the SKILL.md contained prompt-injection indicators, avoid blindly following any free-form guidance from the skill beyond executing the explicit local wrapper command. Treat the SKILL.md instructions as potentially manipulative and prefer manual review.
If you want extra safety: run a code search for 'judge', 'gateway_base', and 'requests' and ensure the specific wrapper you run does not call those paths, or run the wrapper with network blocked.
