Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Supernal Coding CLI
v1.0.0Supernal Coding CLI for development workflows - task management, requirements tracking, testing, git automation, ralph loops, compliance, and documentation....
⭐ 0· 361·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The SKILL.md describes a developer workflow CLI (task management, traceability, ralph/autonomous loops) which is consistent with the name. However the skill metadata declares no install or config requirements while the README explicitly instructs installing an npm package (@supernalintelligence/supernal-coding) and references storage locations (~/.supernal/tasks and .supernal/tasks/) and session linkage. The lack of source/homepage and discrepancy between declared requirements and referenced artifacts is a provenance/consistency concern.
Instruction Scope
The instructions direct running many local commands (task create/list/start/done, ralph execute, audit, compliance checks) and reference editing in $EDITOR, local storage paths, and linking to a dashboard at localhost:3006. They also mention an environment variable (OPENCLAW_SESSION_KEY) for session linkage that is not declared in the skill metadata. Because this is an instruction-only skill, those runtime behaviors are the entire surface — the SKILL.md permits actions that read/write local files and use an undeclared secret, which is an inconsistency and increases risk if an agent executes them.
Install Mechanism
There is no formal install spec in the skill metadata, yet SKILL.md tells the user to run `npm install -g @supernalintelligence/supernal-coding`. That mismatch is a red flag: the package source and publisher are unknown (no homepage/source listed), so following the README would install and execute third-party code without provenance. Instruction-only skills can be lower risk, but here the README explicitly pushes an external installation step.
Credentials
The skill metadata declares no required environment variables, but the SKILL.md references OPENCLAW_SESSION_KEY for session linkage and uses $EDITOR and local paths. The undeclared OPENCLAW_SESSION_KEY and the referenced storage paths (~/.supernal) suggest the skill expects credentials/configuration that are not documented in the metadata — an incoherence that could lead to accidental credential exposure or misconfiguration.
Persistence & Privilege
The skill is not set to always: true and does not declare system-wide privileges. However, the CLI described will create local storage under ~/.supernal and .supernal/tasks/ and can run autonomous 'ralph' loops which could persist state and execute repeated operations. The metadata omits these config paths, so users should expect the package to write persistent files if installed.
What to consider before installing
Before installing or enabling this skill, verify the package provenance and the missing metadata: ask the publisher for the upstream repository or npm package page and confirm the publisher identity. Do not run `npm install -g @supernalintelligence/supernal-coding` unless you can inspect the package source. Confirm whether OPENCLAW_SESSION_KEY and the ~/.supernal storage paths are required and what data they will hold. If an agent will be allowed to invoke this skill autonomously, restrict its ability to run npm installs or execute arbitrary shell commands until you can audit the code. If you cannot obtain a trusted source or code review, treat this as untrusted and avoid installing or granting the agent permission to run the CLI.Like a lobster shell, security has layers — review code before you run it.
latestvk97118c3z3d80ytdmv6ett214h823mzs
License
MIT-0
Free to use, modify, and redistribute. No attribution required.