Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nm Pensive Code Refinement

v1.0.0

Improve code quality: duplication, efficiency, clean code, architectural fit, and error handling

0· 44·1 current·1 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
Name/description (improving duplication, efficiency, clean code, architectural fit, error handling) align with the modules and the commands shown; the requested config paths (shared patterns, safety-critical patterns, proof-of-work) are plausibly related to evidence capture and safety checks used by a code-review/refinement skill.
Instruction Scope
SKILL.md instructs the agent to scan the repository (find/grep/sed/awk/xargs/wc), run Python helpers, and optionally call 'gh pr diff' for PR-scoped analysis. Reading repository files is expected for a code-refinement skill, but the instructions are broad (search whole tree excluding common dirs) and reference utilities and scripts that are not listed as required binaries. The doc also references invoking other plugins/skills (archetypes, conserve, imbue) which may cause the agent to read cross-plugin files or try to use those plugins if available.
Install Mechanism
Instruction-only skill with no install spec or archive downloads. Nothing will be written to disk by an installer — lower install risk.
!
Credentials
Registry metadata lists no required environment variables or credentials, but SKILL.md expects runtime tools and integrations (python3, grep/sed/awk, and optionally the GitHub CLI 'gh' for PR operations). The skill declares required config paths across other Night Market plugins (night-market.pensive:shared, night-market.pensive:safety-critical-patterns, night-market.imbue:proof-of-work). Those config requirements are plausible for evidence capture but broaden the skill's access to cross-plugin configuration/data; the GH CLI/PR use also implies access to GitHub credentials that are not declared.
Persistence & Privilege
No install, no always:true. The skill can be invoked autonomously by default (platform default) but it does not request permanent presence or attempt to modify other skills' configs in the provided files.
What to consider before installing
This skill appears to do what it says (repo-wide static heuristics and suggested refactors), but there are small mismatches you should be aware of before installing: - The SKILL.md expects standard shell tools (find/grep/sed/awk), python3, and may call the GitHub CLI (gh) when run against a PR — yet the registry lists no required binaries or credentials. If you plan to use PR integration, ensure any GitHub token supplied to the agent has the minimum scopes you accept and be aware the skill will read repo files. - The skill declares required config paths from other Night Market plugins (including imbue:proof-of-work). Confirm what data those config entries contain and whether you are comfortable allowing this skill access to them. - Because the skill searches the repository broadly, it will read source and script files. That is expected for a code-refinement tool, but review what scripts (e.g., plugins/conserve/scripts/detect_duplicates.py) it may attempt to execute or import in your environment. What would increase my confidence: explicit declared required binaries (e.g., python3, gh) and an explanation of exactly what is stored/used in the required config paths (especially imbue:proof-of-work). If the author documents which external commands are optional and what credential scopes are needed for PR analysis, the remaining concerns would be resolved.

Like a lobster shell, security has layers — review code before you run it.

Runtime requirements

🦞 Clawdis
Confignight-market.pensive:shared, night-market.pensive:safety-critical-patterns, night-market.imbue:proof-of-work
latestvk97d3bevqsdsaf1adbpa27aqch84xgq3
44downloads
0stars
1versions
Updated 5d ago
v1.0.0
MIT-0

Night Market Skill — ported from claude-night-market/pensive. For the full experience with agents, hooks, and commands, install the Claude Code plugin.

Table of Contents

Code Refinement Workflow

Analyze and improve living code quality across six dimensions.

Quick Start

/refine-code
/refine-code --level 2 --focus duplication
/refine-code --level 3 --report refinement-plan.md

When To Use

  • After rapid AI-assisted development sprints
  • Before major releases (quality gate)
  • When code "works but smells"
  • Refactoring existing modules for clarity
  • Reducing technical debt in living code

When NOT To Use

  • Removing dead/unused code (use conserve:bloat-detector)
  • Removing dead/unused code (use conserve:bloat-detector)

Analysis Dimensions

#DimensionModuleWhat It Catches
1Duplication & Redundancyduplication-analysisNear-identical blocks, similar functions, copy-paste
2Algorithmic Efficiencyalgorithm-efficiencyO(n^2) where O(n) works, unnecessary iterations
3Clean Code Violationsclean-code-checksLong methods, deep nesting, poor naming, magic values
4Architectural Fitarchitectural-fitParadigm mismatches, coupling violations, leaky abstractions
5Anti-Slop Patternsclean-code-checksPremature abstraction, enterprise cosplay, hollow patterns
6Error Handlingclean-code-checksBare excepts, swallowed errors, happy-path-only

Progressive Loading

Load modules based on refinement focus:

  • modules/duplication-analysis.md (~400 tokens): Duplication detection and consolidation
  • modules/algorithm-efficiency.md (~400 tokens): Complexity analysis and optimization
  • modules/clean-code-checks.md (~450 tokens): Clean code, anti-slop, error handling
  • modules/architectural-fit.md (~400 tokens): Paradigm alignment and coupling

Load all for comprehensive refinement. For focused work, load only relevant modules.

Required TodoWrite Items

  1. refine:context-established — Scope, language, framework detection
  2. refine:scan-complete — Findings across all dimensions
  3. refine:prioritized — Findings ranked by impact and effort
  4. refine:plan-generated — Concrete refactoring plan with before/after
  5. refine:evidence-captured — Evidence appendix per imbue:proof-of-work

Workflow

Step 1: Establish Context (refine:context-established)

Detect project characteristics:

# Language detection
find . -not -path "*/.venv/*" -not -path "*/__pycache__/*" \
  -not -path "*/node_modules/*" -not -path "*/.git/*" \
  \( -name "*.py" -o -name "*.ts" -o -name "*.rs" -o -name "*.go" \) \
  | head -20

# Framework detection
ls package.json pyproject.toml Cargo.toml go.mod 2>/dev/null

# Size assessment
find . -not -path "*/.venv/*" -not -path "*/__pycache__/*" \
  -not -path "*/node_modules/*" -not -path "*/.git/*" \
  \( -name "*.py" -o -name "*.ts" -o -name "*.rs" \) \
  | xargs wc -l 2>/dev/null | tail -1

Step 2: Dimensional Scan (refine:scan-complete)

Load relevant modules and execute analysis per tier level.

Step 3: Prioritize (refine:prioritized)

Rank findings by:

  • Impact: How much quality improves (HIGH/MEDIUM/LOW)
  • Effort: Lines changed, files touched (SMALL/MEDIUM/LARGE)
  • Risk: Likelihood of introducing bugs (LOW/MEDIUM/HIGH)

Priority = HIGH impact + SMALL effort + LOW risk first.

Step 4: Generate Plan (refine:plan-generated)

For each finding, produce:

  • File path and line range
  • Current code snippet
  • Proposed improvement
  • Rationale (which principle/dimension)
  • Estimated effort

Step 5: Evidence Capture (refine:evidence-captured)

Document with imbue:proof-of-work (if available):

  • [E1], [E2] references for each finding
  • Metrics before/after where measurable
  • Principle violations cited

Fallback: If imbue is not installed, capture evidence inline in the report using the same [E1] reference format without TodoWrite integration.

Tiered Analysis

TierTimeScope
1: Quick (default)2-5 minComplexity hotspots, obvious duplication, naming, magic values
2: Targeted10-20 minAlgorithm analysis, full duplication scan, architectural alignment
3: Deep30-60 minAll above + cross-module coupling, paradigm fitness, comprehensive plan

Cross-Plugin Dependencies

DependencyRequired?Fallback
pensive:sharedYesCore review patterns
imbue:proof-of-workOptionalInline evidence in report
conserve:code-quality-principlesOptionalBuilt-in KISS/YAGNI/SOLID checks
archetypes:architecture-paradigmsOptionalPrinciple-based checks only (no paradigm detection)

Supporting Modules

When optional plugins are not installed, the skill degrades gracefully:

  • Without imbue: Evidence captured inline, no TodoWrite proof-of-work
  • Without conserve: Uses built-in clean code checks (subset)
  • Without archetypes: Skips paradigm-specific alignment, uses coupling/cohesion principles only

Comments

Loading comments...