Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

glm-basics

v0.1.0

Basic usage of the General Lake Model (GLM) for lake temperature simulation. Use when you need to run GLM, understand input files, or modify configuration pa...

0· 70·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for wu-uk/glm-lake-mendota-glm-basics.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "glm-basics" (wu-uk/glm-lake-mendota-glm-basics) from ClawHub.
Skill page: https://clawhub.ai/wu-uk/glm-lake-mendota-glm-basics
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install glm-lake-mendota-glm-basics

ClawHub CLI

Package manager switcher

npx clawhub@latest install glm-lake-mendota-glm-basics
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description match the instructions: running GLM, editing glm3.nml, and reading bcs/*.csv are expected. However, the SKILL.md instructs cd /root which is not necessary for running GLM and is an odd choice that exposes or assumes access to a privileged user directory.
!
Instruction Scope
Instructions tell the agent to change into /root and run the glm binary and to edit glm3.nml in-place. The /root path is unrelated to the stated purpose and may cause the agent to read or write files in a system user home. The provided Python modifier uses a simplistic regex that can accidentally change unintended numeric tokens in the namelist (risk of corrupting config).
Install Mechanism
There is no install spec (instruction-only), so nothing will be downloaded or written to disk by the skill itself. That is low-risk, but it also means the guide assumes the glm binary is already present; the SKILL.md does not tell the user where to obtain a trusted glm binary.
Credentials
The skill requests no environment variables, credentials, or config paths. That is proportionate for a local GLM usage guide.
Persistence & Privilege
always is false and there is no install step that persists files or modifies agent/system configuration. The skill does not request elevated platform privileges in its metadata.
What to consider before installing
This skill appears to be a simple GLM usage guide, but proceed cautiously. Key points to consider before installing/using: - The SKILL.md tells the agent to cd /root — change that to the working/project directory (or remove it) unless you intentionally want to operate in /root; running in /root can expose unrelated files and assumes elevated environment. - The provided Python namelist editor uses a naive regex that may modify unintended numeric tokens and could corrupt glm3.nml. Prefer using a proper Fortran namelist parser (e.g., f90nml or a library) or ensure strong, parameter-scoped replacements and always keep backups. - Because there's no install information, verify that the glm binary on your system is the official/trusted GLM distribution before running it. If glm is missing, obtain it from the official project/release page rather than installing from an unknown source. - Before running automated edits, back up glm3.nml and review diffs; avoid running the skill with access to system directories you don't want modified. If the maintainers can (a) remove or explain the /root directive, (b) replace the regex approach with a proper namelist parser, and (c) include guidance or a reference to the official GLM distribution, my concerns would be largely resolved.

Like a lobster shell, security has layers — review code before you run it.

latestvk978qvn9r207rhnt3ks8v9dbb184x9z3
70downloads
0stars
1versions
Updated 1w ago
v0.1.0
MIT-0

GLM Basics Guide

Overview

GLM (General Lake Model) is a 1D hydrodynamic model that simulates vertical temperature and mixing dynamics in lakes. It reads configuration from a namelist file and produces NetCDF output.

Running GLM

cd /root
glm

GLM reads glm3.nml in the current directory and produces output in output/output.nc.

Input File Structure

FileDescription
glm3.nmlMain configuration file (Fortran namelist format)
bcs/*.csvBoundary condition files (meteorology, inflows, outflows)

Configuration File Format

glm3.nml uses Fortran namelist format with multiple sections:

&glm_setup
   sim_name = 'LakeName'
   max_layers = 500
/
&light
   Kw = 0.3
/
&mixing
   coef_mix_hyp = 0.5
/
&meteorology
   meteo_fl = 'bcs/meteo.csv'
   wind_factor = 1
   lw_factor = 1
   ch = 0.0013
/
&inflow
   inflow_fl = 'bcs/inflow1.csv','bcs/inflow2.csv'
/
&outflow
   outflow_fl = 'bcs/outflow.csv'
/

Modifying Parameters with Python

import re

def modify_nml(nml_path, params):
    with open(nml_path, 'r') as f:
        content = f.read()
    for param, value in params.items():
        pattern = rf"({param}\s*=\s*)[\d\.\-e]+"
        replacement = rf"\g<1>{value}"
        content = re.sub(pattern, replacement, content)
    with open(nml_path, 'w') as f:
        f.write(content)

# Example usage
modify_nml('glm3.nml', {'Kw': 0.25, 'wind_factor': 0.9})

Common Issues

IssueCauseSolution
GLM fails to startMissing input filesCheck bcs/ directory
No output generatedInvalid nml syntaxCheck namelist format
Simulation crashesUnrealistic parametersUse values within valid ranges

Best Practices

  • Always backup glm3.nml before modifying
  • Run GLM after each parameter change to verify it works
  • Check output/ directory for results after each run

Comments

Loading comments...