Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

SOTA AI Model Tracker

v1.0.0

Provides daily updated authoritative data and APIs tracking state-of-the-art AI models across categories from LMArena, Artificial Analysis, and HuggingFace.

0· 1.8k·0 current·0 all-time
Security Scan
VirusTotalVirusTotal
Suspicious
View report →
OpenClawOpenClaw
Benign
high confidence
Purpose & Capability
The name/README/SKILL.md describe a SOTA model tracker; the code files (scrapers, fetchers, init_db, rest_api, server) match that purpose. The metadata declares no credentials or binaries, which is consistent with a self-hosted Python project that runs scrapers and serves a local API.
Instruction Scope
SKILL.md instructs the user to run scrapers (Playwright + Chromium), pip install requirements, write/overwrite ~/.claude/CLAUDE.md for static embedding, and optionally enable a systemd user timer — all within the stated purpose. These instructions do modify user config and run network scrapers; they're expected for this tool but users should be aware these are persistent, local file and system-level changes.
Install Mechanism
There is no install spec in the skill metadata (instruction-only), but the repo includes requirements.txt, pyproject.toml and scripts that require installing Python deps and Playwright/Chromium. That mismatch is explainable (manual install expected) but worth noting: the skill will require downloads (pip packages and a browser) if you follow SKILL.md.
Credentials
The project does not request secrets or unrelated environment variables. SECURITY.md documents optional env vars (SOTA_CACHE_DIR, SOTA_LOG_LEVEL) but none are required. The scrapers use publicly accessible sources; no credentials are stored in the repo.
Persistence & Privilege
always:false and normal autonomous invocation are set. The runtime instructions recommend creating/updating ~/.claude/CLAUDE.md and enabling a systemd --user timer; those are legitimate user-level persistence actions but they change local configuration and create a periodic task. If enabled, the optional MCP server would run a local service that may be reachable depending on host networking and .mcp.json configuration.
Scan Findings in Context
[pre-scan-injection-signals] expected: Pre-scan reported no injection signals. Given this repo contains many scrapers and network calls, the absence of flagged patterns is plausible; manual review of network calls and scrapers is still recommended before running.
Assessment
What to consider before installing/running: - If you only need up-to-date SOTA data, prefer downloading the published data/sota_export.json or CSV (SKILL.md Option 1) instead of running scrapers or enabling servers. - Running scrapers requires pip install -r requirements.txt and playwright install chromium (downloads a browser binary). Scrapers will make network requests to LMArena, ArtificialAnalysis, HuggingFace, Civitai, etc.; review scraper code if you have policy concerns about any source. - The project will modify user config if you follow the embedding instructions (writes ~/.claude/CLAUDE.md) and may add a user-level systemd timer; these are normal but persistent changes — back up the file first. - If you run the REST API or MCP server locally, consider firewalling or adding authentication (SKILL.md and SECURITY.md show how) so the service isn't exposed publicly by accident. - The repo includes GitHub Actions automation in its workflow docs; if you fork and enable Actions, the workflow will auto-commit updated data to your fork. Be mindful of what you allow a workflow to push from your account. - To reduce risk: run inside a dedicated virtualenv, inspect init_db.py and scrapers for unexpected behavior, use the static JSON export where possible, and avoid enabling MCP or systemd timers until you’re comfortable with the code. Overall this appears coherent and consistent with its stated purpose; the main risks are operational (network access, local file writes, running a local server) rather than deceptive behavior.

Like a lobster shell, security has layers — review code before you run it.

ai-modelsvk97a766f6s21fza5wcvfyqjtkx80h37nanthropicvk97a766f6s21fza5wcvfyqjtkx80h37nhuggingfacevk97a766f6s21fza5wcvfyqjtkx80h37nlatestvk97a766f6s21fza5wcvfyqjtkx80h37nlmsysvk97a766f6s21fza5wcvfyqjtkx80h37nmcpvk97a766f6s21fza5wcvfyqjtkx80h37nrankingsvk97a766f6s21fza5wcvfyqjtkx80h37nsotavk97a766f6s21fza5wcvfyqjtkx80h37n
1.8kdownloads
0stars
1versions
Updated 12h ago
v1.0.0
MIT-0

SOTA Tracker

The definitive open-source database of State-of-the-Art AI models.

Auto-updated daily from LMArena, Artificial Analysis, and HuggingFace.

Why This Exists

AI models are released weekly. Keeping track is impossible. This project:

  1. Curates authoritative data - LMArena Elo rankings, manual curation for video/image/audio models
  2. Updates daily via GitHub Actions
  3. Exports to JSON/CSV/SQLite - Use in your own projects
  4. Provides multiple interfaces - Static files, REST API, or MCP server

Quick Start: Use the Data

Option 1: Download JSON/CSV

# Latest data (updated daily)
curl -O https://raw.githubusercontent.com/romancircus/sota-tracker-mcp/main/data/sota_export.json
curl -O https://raw.githubusercontent.com/romancircus/sota-tracker-mcp/main/data/sota_export.csv

Option 2: Clone and Query Locally

git clone https://github.com/romancircus/sota-tracker-mcp.git
cd sota-tracker-mcp

# Query with sqlite3
sqlite3 data/sota.db "SELECT name, sota_rank FROM models WHERE category='llm_api' ORDER BY sota_rank LIMIT 10"

# List forbidden/outdated models
sqlite3 data/sota.db "SELECT name, reason, replacement FROM forbidden"

Option 3: Use with Claude Code (Recommended)

The recommended approach for Claude Code users is static file embedding (lower token cost than MCP):

# Set up daily auto-update of CLAUDE.md
cp scripts/update_sota_claude_md.py ~/scripts/

# Enable systemd timer (runs at 6 AM daily)
systemctl --user enable --now sota-update.timer

# Or run manually
python ~/scripts/update_sota_claude_md.py --update

This embeds a compact SOTA summary directly in your ~/.claude/CLAUDE.md file.

Option 4: REST API

# Start the API server
uvicorn rest_api:app --host 0.0.0.0 --port 8000

# Query endpoints
curl "http://localhost:8000/api/v1/models?category=llm_api"
curl "http://localhost:8000/api/v1/forbidden"
curl "http://localhost:8000/api/v1/models/FLUX.1-dev/freshness"

Option 5: MCP Server (Optional)

MCP support is available but disabled by default (higher token cost). To enable:

# Edit .mcp.json to add the server config
cat > .mcp.json << 'EOF'
{
  "mcpServers": {
    "sota-tracker": {
      "command": "python",
      "args": ["server.py"]
    }
  }
}
EOF

Data Sources

SourceDataUpdate Frequency
LMArenaLLM Elo rankings (6M+ human votes)Daily
Artificial AnalysisLLM benchmarks, pricing, speedDaily
HuggingFaceModel downloads, trendingDaily
Manual curationVideo, Image, Audio, Video2Audio modelsAs needed

Categories

CategoryDescriptionTop Models (Feb 2026)
llm_apiCloud LLM APIsGemini 3 Pro, Grok 4.1, Claude Opus 4.5
llm_localLocal LLMs (GGUF)Qwen3, Llama 3.3, DeepSeek-V3
llm_codingCode-focused LLMsQwen3-Coder, DeepSeek-V3
image_genImage generationZ-Image-Turbo, FLUX.2-dev, Qwen-Image
videoVideo generationLTX-2, Wan 2.2, HunyuanVideo 1.5
video2audioVideo-to-audio (foley)MMAudio V2 Large
ttsText-to-speechChatterboxTTS, F5-TTS
sttSpeech-to-textWhisper Large v3
embeddingsVector embeddingsBGE-M3

REST API Endpoints

EndpointDescription
GET /api/v1/models?category=XGet SOTA for a category
GET /api/v1/models/:name/freshnessCheck if model is current or outdated
GET /api/v1/forbiddenList outdated models to avoid
GET /api/v1/compare?model_a=X&model_b=YCompare two models
GET /api/v1/recent?days=30Models released in past N days
GET /api/v1/recommend?task=chatGet recommendation for a task
GET /healthHealth check

Run Your Own Scraper

# Install dependencies
pip install -r requirements.txt
pip install playwright
playwright install chromium

# Run all scrapers
python scrapers/run_all.py --export

# Output:
# data/sota_export.json
# data/sota_export.csv
# data/lmarena_latest.json

GitHub Actions (Auto-Update)

This repo uses GitHub Actions to:

  • Daily: Scrape all sources, update database, commit changes
  • Weekly: Create a tagged release with JSON/CSV exports

To enable on your fork:

  1. Fork this repo
  2. Go to Settings → Actions → Enable workflows
  3. Data will auto-update daily at 6 AM UTC

File Structure

sota-tracker-mcp/
├── server.py                    # MCP server (optional)
├── rest_api.py                  # REST API server
├── init_db.py                   # Database initialization + seeding
├── requirements.txt             # Dependencies
├── data/
│   ├── sota.db                  # SQLite database
│   ├── sota_export.json         # Full JSON export
│   ├── sota_export.csv          # CSV export
│   └── forbidden.json           # Outdated models list
├── scrapers/
│   ├── lmarena.py               # LMArena scraper (Playwright)
│   ├── artificial_analysis.py   # AA scraper (Playwright)
│   └── run_all.py               # Unified runner
├── fetchers/
│   ├── huggingface.py           # HuggingFace API
│   └── cache_manager.py         # Smart caching
└── .github/workflows/
    └── daily-scrape.yml         # GitHub Actions workflow

Contributing

Found a model that's missing or incorrectly ranked?

  1. For manual additions: Edit init_db.py and submit a PR
  2. For scraper improvements: Edit files in scrapers/
  3. For new data sources: Add a new scraper and update run_all.py

See CONTRIBUTING.md for full developer setup and PR process.

OpenCode / Agents.md Integration

The repo now supports updating agents.md files for OpenCode agents:

# Update your agents.md with latest SOTA data
python update_agents_md.py

# Minimal version (top 1 model per category, lightweight)
python update_agents_md.py --minimal

# Custom categories and limit
python update_agents_md.py --categories llm_local image_gen --limit 3

# Force refresh from sources first
python update_agents_md.py --refresh

Automation

Add to your cron or systemd timer for daily updates:

# ~: crontab -e
@daily python ~/Apps/sota-tracker-mcp/update_agents_md.py

Or systemd:

# ~/.config/systemd/user/sota-update.service
[Unit]
Description=Update SOTA models for agents
After=network.target

[Service]
ExecStart=%h/Apps/sota-tracker-mcp/update_agents_md.py

[Install]
WantedBy=default.target

# ~/.config/systemd/user/sota-update.timer
[Unit]
Description=Daily SOTA data update
OnCalendar=daily
AccuracySec=1h

[Install]
WantedBy=timers.target

# Enable
systemctl --user enable --now sota-update.timer

See CONTRIBUTING.md for full setup guide

Data Attribution & Legal

This project aggregates publicly available benchmark data from third-party sources. We do not claim ownership of rankings, Elo scores, or benchmark results.

Data Sources (Used With Permission)

SourceDataPermission
LMArenaChatbot Arena Elo rankingsrobots.txt: Allow: /
Artificial AnalysisLLM quality benchmarksrobots.txt: Allow: / (explicitly allows AI crawlers)
HuggingFaceModel metadata, downloadsPublic API
Open LLM LeaderboardOpen-source LLM benchmarksCC-BY license

Disclaimer

  • All benchmark scores and rankings are the intellectual work of their respective sources
  • This project provides aggregation and tooling, not original benchmark data
  • Data is scraped once daily to minimize server load
  • If you are a data source and wish to be excluded, please open an issue

Fair Use

This project:

  • Aggregates factual data (not copyrightable)
  • Adds value through tooling (API server, unified format, forbidden list)
  • Attributes all sources with links
  • Does not compete commercially with sources
  • Respects robots.txt permissions

License

MIT - See LICENSE for details.

The code in this repository is MIT licensed. The data belongs to its respective sources (see attribution above).

Comments

Loading comments...