Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Gpu Cluster Manager
v1.4.1Turn your spare GPUs into one inference endpoint. Auto-discovers machines on your network, routes requests to the best available device, learns when your mac...
⭐ 0· 185·2 current·2 all-time
byTwin Geeks@twinsgeeks
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The skill's name and instructions (install ollama-herd, run herd/herd-node, provide a local OpenAI-compatible endpoint) match the stated purpose. However, the registry metadata declares no requirements while SKILL.md includes its own metadata requiring network tools (curl/wget), optional python/pip, and config paths (~/.fleet-manager/...). That mismatch is incoherent and should be explained by the publisher.
Instruction Scope
Runtime instructions tell the user to pip install a PyPI package and run herd/herd-node; the service auto-discovers via mDNS, auto-pulls models to nodes, and implements 'meeting detection' that pauses inference when camera/mic are active on macOS. These behaviors imply access to network, disk, and system sensors (camera/microphone). SKILL.md does not detail where pulled models come from, what permissions are required/used for meeting detection, or any safeguards for auto-downloads or sensitive sensor access.
Install Mechanism
The skill is instruction-only (no install spec in registry) but tells users to run `pip install ollama-herd` (PyPI). Installing a third-party pip package is a moderate-risk install mechanism because install-time code can execute arbitrary actions. SKILL.md's declared homepage (a GitHub repo) exists in the file but the registry entry lists no homepage — another inconsistency to resolve.
Credentials
No environment variables or external credentials are requested, which is proportionate. However, requested config paths (~/.fleet-manager/latency.db, logs/herd.jsonl) indicate the skill will write local telemetry. The meeting-detection feature implies access to camera/mic state on macOS, which is sensitive; auto-pull will download large models over the network and write them to disk. These resource and privacy implications are not made explicit in the registry metadata.
Persistence & Privilege
The skill is not set to always:true and does not request system-wide config changes in the registry. It will create local files under the user's home (~/.fleet-manager) and requires installing a pip package, which is typical. Autonomous invocation is allowed by default (expected) but combined with network/model-download and sensor access increases blast radius—worth caution but not an immediate privilege misconfiguration in the manifest.
What to consider before installing
Before installing: verify the upstream project and PyPI package (check the GitHub repo, package maintainers, and release history); inspect the package source if possible (pip install can run arbitrary code during install). Be aware the tool auto-downloads models (large disk and network use) and can access system sensors (macOS camera/mic) for meeting-detection—decide whether you want those capabilities. If you proceed, run the package in an isolated environment (VM/container) or on a machine you can sacrifice disk/network access from, restrict network egress if you need to control where models are downloaded from, and review/grep the installed package files for unexpected behavior. Ask the publisher to resolve the registry vs SKILL.md inconsistencies (declared requirements, homepage) and to document where models are pulled from and what permissions meeting-detection uses.Like a lobster shell, security has layers — review code before you run it.
apple-siliconvk974tmrp0b47tnz26y4snb7shh840efbcost-savingsvk9733p3xgamybybccab54cqxxh83fkrjdeepseekvk974tmrp0b47tnz26y4snb7shh840efbfleetvk975nmx84790hqa0zhzarxparx83x47hgpu-clustervk974tmrp0b47tnz26y4snb7shh840efbgpu-inferencevk974gny01cgzj011rj60gtnss183wqk2home-labvk9733p3xgamybybccab54cqxxh83fkrjhomelabvk974tmrp0b47tnz26y4snb7shh840efblatestvk970kmh837b52jc0t62d4dcg5h8457qhllamavk974tmrp0b47tnz26y4snb7shh840efblocal-aivk974tmrp0b47tnz26y4snb7shh840efbm4-maxvk974tmrp0b47tnz26y4snb7shh840efbm4-ultravk974tmrp0b47tnz26y4snb7shh840efbmac-minivk974tmrp0b47tnz26y4snb7shh840efbmac-provk973rq5fvxrbarrdk4scjfr6mh83xbjymac-studiovk974tmrp0b47tnz26y4snb7shh840efbmacbook-provk973rq5fvxrbarrdk4scjfr6mh83xbjyphivk974tmrp0b47tnz26y4snb7shh840efbqwenvk974tmrp0b47tnz26y4snb7shh840efbself-hostedvk974tmrp0b47tnz26y4snb7shh840efbzero-configvk974tmrp0b47tnz26y4snb7shh840efb
License
MIT-0
Free to use, modify, and redistribute. No attribution required.