Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
TurboQuant+ KV Cache Compression
v1.0.0TurboQuant+ compresses llama.cpp KV caches on Apple Silicon up to 6.4x with minimal quality loss, enabling larger models and longer contexts efficiently.
⭐ 0· 79·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description claim KV cache compression for llama.cpp on Apple Silicon; the SKILL.md and README exclusively describe using a TurboQuant llama.cpp fork, relevant CLI flags, and platform-specific tuning. No unrelated credentials, binaries, or services are requested.
Instruction Scope
Instructions stay on-topic (clone/build the turboquant fork, run llama-server with cache-type flags). They also recommend a system-level change (sudo sysctl iogpu.wired_limit_mb) to raise GPU memory caps for large contexts — this is relevant to the stated goal but requires elevated privileges and modifies system state. No instructions collect or transmit user data to unexpected endpoints.
Install Mechanism
The skill is instruction-only (no install spec), but its README instructs cloning and building a GitHub repository (TheTom/llama-cpp-turboquant). Downloading and compiling third-party code from GitHub is common for this domain but is a moderate operational risk if the repository is untrusted or has malicious contents. The skill itself does not provide an automated installer or opaque download URLs.
Credentials
No environment variables, credentials, or config paths are requested. The requested actions (build/run a local server, sysctl) are proportionate to compressing KV caches for local inference.
Persistence & Privilege
Skill does not request persistent inclusion (always: false) and does not attempt to modify other skills or agent-wide configs. It does recommend a one-off privileged sysctl change (requires sudo) which alters system GPU memory limits until reboot; this is a legitimate but privileged action and not an automatic persistent installation by the skill.
Scan Findings in Context
[no_regex_findings] expected: Static scanner had no code files to analyze (instruction-only skill). README and SKILL.md reference cloning a GitHub repo; absence of local code is expected but means static analysis did not inspect the third-party repo.
Assessment
This skill appears coherent for configuring TurboQuant+ with llama.cpp, but follow these precautions before proceeding: 1) Verify the external GitHub fork (TheTom/llama-cpp-turboquant) is the intended project and review its source/commit history before building. 2) Build and run the code in an isolated or trusted environment (container, dedicated machine) if possible. 3) Be cautious with the suggested sudo sysctl change (iogpu.wired_limit_mb): it requires elevated privileges and changes system GPU memory limits until reboot—backup important state and understand the impact. 4) Prefer official releases/tags rather than an unknown commit/branch. 5) Check checksums/signatures for any downloaded model files. If you are uncomfortable reviewing or building third-party native code, treat this as an operational risk and avoid running the build on production systems.Like a lobster shell, security has layers — review code before you run it.
latestvk974nf8dp50fw01fwjkqjqkbzd846xepllmvk974nf8dp50fw01fwjkqjqkbzd846xepquantizationvk974nf8dp50fw01fwjkqjqkbzd846xep
License
MIT-0
Free to use, modify, and redistribute. No attribution required.