Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

LLM-WikiMind MCP Setup

v1.0.0

Install and configure the LLM-WikiMind MCP server — a local knowledge base built on Karpathy's LLM Wiki pattern. Triggers: install wikimind, setup knowledge...

0· 69·0 current·0 all-time

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for hal-9909/llm-wikimind-mcp.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "LLM-WikiMind MCP Setup" (hal-9909/llm-wikimind-mcp) from ClawHub.
Skill page: https://clawhub.ai/hal-9909/llm-wikimind-mcp
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Required binaries: python3, git
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install llm-wikimind-mcp

ClawHub CLI

Package manager switcher

npx clawhub@latest install llm-wikimind-mcp
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The name/description (LLM-WikiMind MCP server) aligns with the required binaries (python3, git) and the runtime actions (git clone, start a Python server). However the SKILL.md uses pip3 but pip3 is not listed in required binaries, and it expects the WIKIMIND_ROOT environment variable in the registration examples even though requires.env is empty. Those omissions are inconsistent with the declared metadata.
Instruction Scope
Instructions are focused on installing, initializing, and running the local wiki and MCP server. They do instruct modifying user configuration files (append auto-start line to ~/.zshrc and editing client config like Claude's JSON) and starting a background watcher that auto-syncs. The instructions do not ask for secrets or for reading unrelated system files, but they do direct writes to user config files and create a persistent background process.
Install Mechanism
Installation is instruction-only: git clone from GitHub (expected) and pip3 install qmd (PyPI). These are common, but installing arbitrary PyPI packages and running code from a cloned repo can execute arbitrary code — the package 'qmd' and the repository contents should be reviewed before running. The optional npx clawhub@latest command (npm) is another package install to be reviewed if used.
!
Credentials
No credentials or sensitive env vars are requested, which fits a local-only wiki. However the SKILL.md expects WIKIMIND_ROOT to be set/provided when registering the MCP server, yet requires.env is empty. Also pip3 is used but not declared as a required binary. These are mismatches between declared requirements and the runtime instructions.
Persistence & Privilege
The skill does not force inclusion (always: false). Still, it recommends persistent changes: starting a background watcher, appending a command to ~/.zshrc for auto-start, and registering a local MCP server in client configs. Those are normal for a local service installer but are persistent and will run code on login/in the background until removed.
What to consider before installing
This skill appears to be a legitimate installer for a local knowledge-base MCP, but take a few precautions before proceeding: - Inspect the GitHub repo code (especially .wiki-mcp/server.py and the 'wikimind' scripts) before running them; cloned code runs locally and can do anything your user account can do. - Check the PyPI package 'qmd' (pip3 install qmd) before installing; consider using a Python virtualenv to avoid changing your global site-packages. - Ensure you have pip3 available (the SKILL.md uses pip3, but required binaries omit it); install pip3 or adapt commands accordingly. - Back up ~/.zshrc and any client config files (e.g., Claude config) before letting the installer append or edit them. - Be aware that the watcher starts a background process and the server will be reachable locally; if you care about network exposure, review the server binding/ports and use a firewall or x-local-only binding. - If you want stronger isolation, run the service under a dedicated user or inside a container. - Ask the publisher to update metadata to declare pip3 as a required binary and to mention WIKIMIND_ROOT as an expected env variable so the manifest matches the runtime instructions.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

Binspython3, git
BM25vk97brx87tj04x0qdc1r1y4frxn84vcssMCPvk97brx87tj04x0qdc1r1y4frxn84vcsskarpathyvk97brx87tj04x0qdc1r1y4frxn84vcssknowledge-basevk97brx87tj04x0qdc1r1y4frxn84vcsslatestvk97brx87tj04x0qdc1r1y4frxn84vcssllm-wikivk97brx87tj04x0qdc1r1y4frxn84vcsslocal-firstvk97brx87tj04x0qdc1r1y4frxn84vcsssecond-brainvk97brx87tj04x0qdc1r1y4frxn84vcsssetupvk97brx87tj04x0qdc1r1y4frxn84vcsswikivk97brx87tj04x0qdc1r1y4frxn84vcss
69downloads
0stars
1versions
Updated 1w ago
v1.0.0
MIT-0

LLM-WikiMind MCP Setup Skill

Set up the LLM-WikiMind MCP server — a local knowledge base built on Karpathy's LLM Wiki pattern.

What you get: 5 MCP tools (wiki_search, wiki_get, wiki_list, wiki_ingest_note, wiki_domains) backed by BM25 full-text search over your local Markdown files. No embeddings, no vector DB, no cloud.

Trigger phrases

  • "Install WikiMind" / "Set up my knowledge base MCP"
  • "Configure wiki-kb" / "llm-wikimind setup"
  • "安装知识库 MCP" / "配置 wiki-kb" / "搭建个人知识库"

Installation Workflow

Step 1: Install the only dependency

pip3 install qmd

Step 2: Clone the repo

git clone https://github.com/HAL-9909/llm-wikimind
cd llm-wikimind

Step 3: Initialize the wiki

Run the interactive setup — it will ask where to store the knowledge base and handle everything else:

./wikimind init

Options:

CommandWhen to use
./wikimind initCreate a fresh wiki (interactive, asks for path)
./wikimind init ~/my-notes --adoptAdopt an existing Markdown directory

init automatically:

  • Creates the standard wiki directory structure
  • Copies the MCP server and watcher into the wiki
  • Builds the initial BM25 search index
  • Prints the exact config snippet to paste into the AI client

Step 4: Register the MCP server

The init command prints the exact snippet. For reference:

CatDesk / OpenClaw:

catdesk mcp add --name wiki-kb --json '{
  "command": "python3",
  "args": ["<WIKIMIND_ROOT>/.wiki-mcp/server.py"],
  "env": {"WIKIMIND_ROOT": "<WIKIMIND_ROOT>"}
}'

Replace <WIKIMIND_ROOT> with the path chosen in Step 3 (e.g. ~/Documents/wiki).

Claude Desktop — add to ~/Library/Application Support/Claude/claude_desktop_config.json:

{
  "mcpServers": {
    "wiki-kb": {
      "command": "python3",
      "args": ["<WIKIMIND_ROOT>/.wiki-mcp/server.py"],
      "env": { "WIKIMIND_ROOT": "<WIKIMIND_ROOT>" }
    }
  }
}

Step 5: Start the auto-sync watcher

./wikimind start

Auto-start on login:

echo '/path/to/llm-wikimind/wikimind start > /dev/null 2>&1' >> ~/.zshrc

Step 6: Verify

./wikimind status

Expected output:

→ Wiki root:  ~/Documents/wiki
✓ Wiki exists — 1 domain(s), 3 pages
✓ Watcher running (pid 12345)
✓ qmd installed

MCP Tools Reference

Once registered, these 5 tools are available to any MCP-compatible AI client:

ToolDescription
wiki_searchBM25 full-text search across all domains
wiki_getRead a specific page in full
wiki_listList pages by domain and/or type
wiki_ingest_noteWrite a new page + rebuild index + sync cache
wiki_domainsList all registered domains and their trigger keywords

Auto-update: always in sync

The watcher runs in the background and keeps everything current automatically:

  • Add a new domain folder → detected within 10 seconds → MCP tool descriptions updated
  • Edit DOMAIN.md keywords → AI knows about the change in the next conversation
  • AI writes a new page via wiki_ingest_note → index rebuilt automatically

No restarts. No manual config changes.


Adding knowledge after setup

Install the companion ingest skill:

npx clawhub@latest install wikimind-ingest

Then just say: "Add this to my knowledge base: [paste content or URL]"


Troubleshooting

qmd: command not found → Run pip3 install qmd

MCP server not responding → Check ./wikimind status and ensure WIKIMIND_ROOT is set correctly

Watcher not running → Run ./wikimind start; add to ~/.zshrc for auto-start

New domain not detected → Ensure DOMAIN.md has a keywords frontmatter field; check ./wikimind status

Comments

Loading comments...