Build ROSE tools using a container
v1.0.0Build and run ROSE compiler tools using ROSE installed in a Docker container. Use when developing source-to-source translators, call graph analyzers, AST processors, or any tool that links against librose.so. Triggers on "ROSE tool", "callgraph", "AST traversal", "source-to-source", "build with ROSE", "librose".
⭐ 0· 782·0 current·0 all-time
byChunhua Liao@chunhualiao
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's purpose (build/run ROSE tools in a container) is plausible, but the metadata declares no required binaries while the runtime instructions clearly require Docker (docker run/exec/start). Example commands also mount a hard-coded host path (/home/liao/rose-install) which is host-specific and surprising for a general skill. The skill should have declared Docker and clarified how the 'rose-dev:latest' image is obtained.
Instruction Scope
SKILL.md instructs the agent/user to run Docker containers, mount host directories (including a hard-coded /home/liao path), run make, set LD_LIBRARY_PATH/ulimit, and exec into containers. It also references an environment variable $ROSE in troubleshooting that is never defined elsewhere (Makefile uses ROSE_INSTALL=/rose/install). The instructions therefore reference host paths and env vars beyond what the skill declares and give the agent implicit permission to mount host files into a container.
Install Mechanism
This is an instruction-only skill (no install spec), which minimizes on-disk installs. However it relies on a container image named 'rose-dev:latest' with no source or registry referenced — pulling or running that image could execute arbitrary code. The lack of an install spec is low-risk by itself but combined with an unspecified image is a noteworthy gap.
Credentials
The skill declares no required environment variables or credentials, which fits a local build helper. Still, the instructions reference $ROSE and suggest exporting LD_LIBRARY_PATH and using ulimit; those env/path manipulations are reasonable for native builds but the use of an undefined $ROSE variable and the hard-coded host mount path are incongruent with the declared requirements.
Persistence & Privilege
The skill does not request persistent presence (always:false) and it is instruction-only, so it does not attempt to modify other skills or agent-wide configuration. Autonomous invocation is allowed by default but not combined with broad credential access here.
What to consider before installing
This skill appears to be a set of instructions for using a Docker image to build ROSE-based tools, but there are inconsistencies you should resolve before running anything:
- Confirm you have Docker installed; the skill does not declare this but the commands require it. Install and test 'docker' locally first.
- The image name 'rose-dev:latest' is unspecified (no registry or digest). Only run/pull container images from a trusted registry or use an explicit image digest, or build the image locally from a trusted Dockerfile.
- The example mounts a host path '/home/liao/rose-install' — replace this with your actual path. Avoid mounting sensitive host directories into containers and prefer read-only mounts where possible.
- The SKILL.md refers to $ROSE in troubleshooting but the Makefile uses ROSE_INSTALL=/rose/install. Decide which variable you will actually use and set it explicitly when running the container to avoid confusion.
- Be cautious about running containers as root or with elevated privileges; consider running with reduced capabilities, a user mapping, or appropriate security flags (e.g., --security-opt, --cap-drop) if the image is untrusted.
- The instruction to set ulimit -s unlimited can impact the host; only do this if you understand the implications.
If you cannot verify the origin of the 'rose-dev:latest' image or prefer tighter control, obtain/build the container image from a trusted source (or inspect its Dockerfile) and update the skill instructions to declare Docker as a required binary and to use explicit, non-host-specific paths and environment variables.Like a lobster shell, security has layers — review code before you run it.
latestvk97aq3sfsd836g6tpw5846818n811ers
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
