lobster-rank

Scan locally installed OpenClaw skills, collect evidence data, submit to the lobster ranking server for scoring, and let the user confirm uploading their res...

Security Scan

The skill's code and instructions match its stated purpose (scanning local OpenClaw skills and sending structural metadata to a third‑party leaderboard) and the requested API key is appropriate for that purpose.

Purpose & Capability

Name/description match what the files do: the included Python script scans skill directories, extracts metadata/flags, and submits them to a Lobster leaderboard server. The required OPENCLAW_API_KEY is appropriate for authenticating submissions.

Instruction Scope

The SKILL.md promises 'no file contents' are sent; the script does not upload full file contents but it does read SKILL.md files to extract a one-line description and to run heuristics (keyword scanning) that produce flags sent to the server. It also reads openclaw.json to extract an apiKey. This is within the advertised behavior but means the skill inspects local SKILL.md text and config files (not full contents) for heuristic signals.

Install Mechanism

Instruction-only with an included Python script; no installers, external downloads, or exotic package installs are present. Risk from install mechanism is low.

Credentials

Only an API key for the Lobster service (OPENCLAW_API_KEY) is required and the script also optionally reads the local openclaw.json to obtain that key. No unrelated credentials, secrets, or high‑privilege environment variables are requested.

Persistence & Privilege

The skill does not request always:true, does not modify other skills or system settings, and is user‑invocable only. It does not persist extra privileges or write installers.

Assessment

This skill will scan your OpenClaw skill folders and submit structural metadata and heuristic flags (skill names, file counts, a short description line, presence of scripts/assets, and keyword-based model routing signals) to https://lobster-rank.wondercv.com for scoring. That behavior is consistent with its description, but you should: (1) only provide an OPENCLAW_API_KEY you trust the Lobster operator to receive; (2) consider running with --dry-run first to inspect what the scanner finds locally before sending anything; (3) review the script if you are worried about sensitive data — it does not upload log or config contents, only a boolean/log-availability flag and extracted metadata, but it does read SKILL.md and openclaw.json to derive those signals; and (4) verify you trust the lobster-rank.wondercv.com operator before confirming uploads to the public leaderboard.

This skill scans your locally installed OpenClaw skills, collects metadata (skill names, structure flags, file counts, descriptions), and submits it to the lobster leaderboard server for scoring. No file contents, credentials, or personal data are sent — only structural metadata and heuristic signals. The scoring algorithm runs server-side.

Prerequisites

You need a Lobster API Key before submitting.

• Get it at: https://lobster-rank.wondercv.com/me
• Set it as an environment variable for convenience:

  export OPENCLAW_API_KEY=your_key_here
  

• Or pass it directly with --api-key on every command.

Privacy note: The script reads openclaw.json only to extract your apiKey field for authentication — no other fields are used or transmitted. It collects skill metadata (skill names, whether scripts/references/assets exist, file count, description) and heuristic signals (multi-model usage, log availability). No file contents, credentials, or personal data are sent. All data is submitted to the leaderboard server at https://lobster-rank.wondercv.com which is operated by the skill publisher.

Workflow

Step 1 — Scan & Submit

Run the scanner. It collects metadata about your installed skills and sends the raw data to the server for scoring.

python3 scripts/lobster_submit.py

With explicit API key:

python3 scripts/lobster_submit.py --api-key lbk_xxxxxxxxxxxx

Live Challenge mode (higher credibility, blends in a real-time challenge score):

python3 scripts/lobster_submit.py --mode live-challenge --challenge-score 85

Dry run (scan only, do not send to server):

python3 scripts/lobster_submit.py --dry-run

Step 2 — Review the Result

The script prints the score returned by the server. Present it to the user in a readable format, including:

• Total score and grade
• Title
• Number of skills counted
• Evaluation mode
• Pending token expiry time

Ask the user: "要将这个成绩上传到排行榜吗？"

If they say yes, proceed to Step 3. If no, stop — the pending score stays valid for 24 hours and can be confirmed on the website.

Step 3 — Confirm Upload

Pass the pending_token from Step 2:

python3 scripts/lobster_submit.py --confirm <pending_token>

On success the script prints a confirmation. Tell the user their score is now on the leaderboard.

Step 4 — View on Leaderboard

Direct the user to:

https://lobster-rank.wondercv.com

Or their personal page:

https://lobster-rank.wondercv.com/me

Discovery Paths

The scanner checks these locations for skills:

• ~/.openclaw/workspace/skills
• ~/Library/Application Support/QClaw/openclaw/config/skills

And these for config / logs:

• ~/.openclaw/openclaw.json
• ~/Library/Application Support/QClaw/openclaw/config/openclaw.json
• ~/Library/Logs/QClaw/openclaw

To scan a custom path:

python3 scripts/lobster_submit.py --root /path/to/skills

Rules

• Do not invent skills or fabricate evidence.
• The scoring algorithm runs server-side; do not attempt to predict or influence it.
• If no user-installed skills are found, stop and report the issue.
• If the API key is missing or invalid, ask the user to retrieve it from https://lobster-rank.wondercv.com/me.
• If the pending token has expired, re-run Step 1 to get a fresh evaluation.