Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Karpathy Lint
v1.0.0Performs quality checks on Karpathy LLM knowledge points including deduplication, merging, updating, and generates reports on knowledge base health.
⭐ 0· 10·0 current·0 all-time
bysune@sora-mury
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes deduplication, merging, and merging helper modules (dedup.py, merger.py), but the package only includes scripts/__init__.py and test_lint.py — the named helper modules are missing. That mismatch suggests the bundle is incomplete or the implementation is different from the documentation.
Instruction Scope
The code's KnowledgePointParser defaults to a path three levels up plus /knowledge/knowledge-points, i.e. it reads and writes files outside the skill folder (repository-root/knowledge/knowledge-points). This will access user filesystem data outside the skill directory and write lint-report.md there. The SKILL.md mentions Phase 2 knowledge files but does not make the exact path/side-effects explicit.
Install Mechanism
No install steps or external downloads are present (instruction-only with included scripts), so there is no installer that would fetch remote code. This reduces installation-time supply-chain risk.
Credentials
The skill doesn't request any environment variables or external credentials, which is proportional to its stated purpose. However, because it directly reads and writes files outside its own directory, it effectively requires filesystem access to the user's knowledge directory — confirm that the default path matches where you want it to operate or that you will pass an explicit, safe path.
Persistence & Privilege
The skill is not always-enabled and does not declare system-wide privileges. It does write reports and can save updated knowledge-point files into the inferred knowledge directory, which is expected for a lint/repair tool but is a form of persistent modification to user data (not to other skills or system configs).
What to consider before installing
Before installing or running: (1) Confirm the repository includes the missing modules (dedup.py, merger.py or equivalent) — the SKILL.md lists files that are not present. (2) Inspect the remainder of scripts/__init__.py (it was truncated in the review) for any network calls, secrets exfiltration, or code that calls external services (M-Flow integration was mentioned). (3) Note the default behavior: it will read from and write to a sibling/parent 'knowledge/knowledge-points' directory (outside the skill folder). If that path is not where you want it to operate, run it with an explicit kp_path pointing to a safe sandbox copy. (4) Run the tests in a sandboxed environment or container with only sample knowledge files to observe behavior. (5) If you don't trust the unknown source, request a homepage or source repo and a complete file listing from the publisher before use.Like a lobster shell, security has layers — review code before you run it.
latestvk974c465wjpj5ae89ks6j372958496eq
License
MIT-0
Free to use, modify, and redistribute. No attribution required.