Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Intent-Engineering

v1.0.0

A meta-framework for designing, building, and orchestrating an ecosystem of strategically-aligned agent skills. This skill governs how the agent itself opera...

0· 72·0 current·0 all-time
byDaniel Foo Jun Wei@danielfoojunwei

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for danielfoojunwei/intent-engineer.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Intent-Engineering" (danielfoojunwei/intent-engineer) from ClawHub.
Skill page: https://clawhub.ai/danielfoojunwei/intent-engineer
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install intent-engineer

ClawHub CLI

Package manager switcher

npx clawhub@latest install intent-engineer
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name, description, and provided resources (skill_registry.json, data contracts, governance docs, scripts/orchestrator.py) are coherent with a meta-framework for building and orchestrating skill ecosystems. The files present match the claimed purpose. One provenance note: the source/homepage is unknown which reduces trust but does not itself make the capability incoherent.
!
Instruction Scope
SKILL.md explicitly instructs the agent to use this framework to guide its own reasoning and to 'improve and extend the intent-engineering skill itself' (recursive self-modification). That is a broad, open-ended instruction granting the agent discretion to modify skills, register new skills, and orchestrate calls across the ecosystem. The instructions reference scripts/orchestrator.py and various registries — they do not declare explicit limits on what the agent may read or write, creating scope creep and risk of unintended changes to skill files or registries.
Install Mechanism
No install spec or external downloads are declared; the package is instruction-plus-bundled-files only. There are included Python scripts (scripts/*.py) but nothing in the metadata indicates remote code fetching or archive extraction. This lowers install-time supply-chain risk, but the presence of executable scripts means runtime execution could perform privileged actions if allowed.
Credentials
The skill declares no required environment variables or credentials, which is appropriate for a governance/orchestration framework. However, bundled Python scripts may still access environment variables, files, or network at runtime; SKILL.md does not enumerate or constrain what env/config the scripts may use. Because provenance is unknown, this is a cautionary signal rather than a confirmed mismatch.
!
Persistence & Privilege
always:false and normal autonomous invocation are set (no immediate red flag). But the skill's explicit goal of self-governance and recursive improvement implies it may modify registry files, templates, or skill files (which are included). The combination of executable scripts + instructions to update/extend the ecosystem suggest it could alter other skills or system artifacts if the agent has filesystem or config write permissions. That potential to persist changes across runs is a notable privilege to be aware of.
What to consider before installing
This skill appears to implement a plausible meta-framework, but it also instructs the agent to modify and govern its own skills — a powerful capability that can change behavior persistently. Before installing or enabling: 1) Review the Python scripts (scripts/orchestrator.py, contract_validator.py, ecosystem_analyzer.py) for any network calls, arbitrary code execution, file write operations, subprocess uses, or reads of environment/credential files. 2) Run the skill in a tightly restricted sandbox (no write access to skill bundles or system-wide config) until you are confident of its behavior. 3) If you plan to allow it to run autonomously, ensure audit logging and human-in-the-loop gating for any actions that change skill code, registries, or escalate privileges. 4) Because the source/homepage is unknown, prefer a manual code review and consider limiting its permissions (filesystem, network, ability to modify other skills) or using a vetted alternative. If you want, I can summarize the orchestrator.py and other scripts line-by-line to highlight risky operations to inspect.
scripts/orchestrator.py:459
Dynamic code execution detected.
Patterns worth reviewing
These patterns may indicate risky behavior. Check the VirusTotal and OpenClaw results above for context-aware analysis before installing.

Like a lobster shell, security has layers — review code before you run it.

latestvk97f3rm8k7ey7v8pn21nhevey1849kx2
72downloads
0stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Intent Engineering: The Agent's Operating System

Overview

This skill is more than a tool; it is the operating system for the agent itself. It provides a comprehensive meta-framework for building and managing an ecosystem of interconnected agent skills. When you ask the agent to build something, it uses this very skill to guide its own reasoning, decision-making, and implementation process.

This framework extends the principles of intent engineering to a multi-skill environment and, critically, to the agent's own behavior. It introduces a structured approach to ecosystem architecture, data governance, skill composition, shared intent, and agent self-governance.

The Agent as the Orchestrator

The agent is not just a passive tool; it is the active orchestrator of this entire framework. This creates a virtuous cycle of recursive improvement.

  1. Intent Amplification: The agent takes your high-level, sometimes "shallow," prompts and uses this framework to translate them into well-architected, robust, and aligned skills.
  2. Complexity Absorption: The agent handles the intricate details of data contracts, orchestration patterns, and governance, allowing you to focus on strategic intent.
  3. Self-Referential Governance: The agent applies the principles of this framework to itself. Its decisions are logged, its outputs are validated against data contracts, and its actions are aligned with the shared intent. This is meta-governance.
  4. Recursive Improvement: The agent uses the intent-engineering skill to improve and extend the intent-engineering skill itself, creating a self-improving system.

The Intent-Driven Skill Ecosystem Architecture

An aligned skill ecosystem consists of five core components that work together to ensure that individual skills are greater than the sum of their parts.

ComponentDescriptionImplementation
1. Skill RegistryA centralized, machine-readable inventory of all available skills, their capabilities, dependencies, and data contracts.references/skill_registry.json
2. Data ContractsFormal schemas (JSON Schema) defining the inputs and outputs for each skill, ensuring predictable and reliable data exchange.references/data_contracts/
3. Orchestration EngineA system for defining and executing workflows that compose multiple skills, handling data flow, and managing dependencies.scripts/orchestrator.py
4. Shared Intent FrameworkA global set of organizational goals, values, and decision boundaries that all skills inherit, ensuring consistent alignment.references/shared_intent.md
5. Agent Decision FrameworkThe internal guidance system the agent uses to apply this framework, amplify user intent, and govern its own actions.references/agent_decision_framework.md

The Enhanced 4-Phase Workflow

The agent follows this workflow when you ask it to build or modify a skill.

Phase 1: Deconstruct Intent (Ecosystem-Aware)

Objective: To define a skill's strategic purpose within the context of the broader ecosystem.

New Workflow Steps:

  1. Define Skill's Role: In addition to its own goal, define how this skill contributes to the overall ecosystem.
  2. Align with Shared Intent: Consult the references/shared_intent.md to ensure the skill's values and boundaries are consistent with organizational-level principles.
  3. Identify Dependencies: Use the references/skill_registry.json to identify any existing skills this new skill will depend on.

Phase 2: Map Capabilities & Define Data Contracts

Objective: To define the skill's tasks and formalize its data interfaces.

New Workflow Steps:

  1. Design Workflow: Decompose the skill's tasks as before.
  2. Define Data Contracts: For each input and output, create a formal JSON Schema in the references/data_contracts/ directory.
  3. Specify Data Lineage: Document where the skill's input data comes from and where its output data goes.

Phase 3: Build Infrastructure & Register the Skill

Objective: To build the skill's resources and make it discoverable by the ecosystem.

New Workflow Steps:

  1. Build Resources: Create scripts and templates as before.
  2. Register the Skill: Add a new entry to the references/skill_registry.json.

Phase 4: Implement, Orchestrate, and Iterate

Objective: To implement the skill's logic, including its interactions with other skills.

New Workflow Steps:

  1. Implement Logic: Write the core logic for the skill.
  2. Orchestrate Interactions: Use the scripts/orchestrator.py to call other skills.
  3. Validate and Deliver: Validate the skill and its interactions within the ecosystem.

Resources for Ecosystem Orchestration

This skill now includes a richer set of resources to manage the entire ecosystem:

  • references/shared_intent.md: Defines the global values and goals for the entire organization.
  • references/skill_registry.json: A central catalog of all skills.
  • references/data_contracts/: A directory containing all data contract schemas.
  • references/agent_decision_framework.md: The agent's internal guidance for applying this framework.
  • references/recursive_skill_development.md: A guide on how the agent can improve this skill itself.
  • scripts/orchestrator.py: A Python script for composing and executing multi-skill workflows.
  • templates/agent_audit_log.md: A template for auditing the agent's own actions during skill creation.

Comments

Loading comments...