Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
First Principles Thinking
v1.0.0第一性原理思维框架。强制 Agent 从原始需求和问题本质出发，不从惯例或模板出发。始终生效。触发词：第一性原理、first principles、从本质出发、追根因。
⭐ 0· 55·0 current·0 all-time
by@wavmson
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name/description match the content: this is a pure, instruction-only thinking framework that changes agent behavior. No unrelated binaries, env vars, or config paths are requested.
Instruction Scope
SKILL.md contains detailed runtime instructions telling the agent to always apply the thinking rules, ask clarifying questions, suggest simpler alternatives, and log notable decisions. It does not instruct the agent to read files, exfiltrate data, call external endpoints, or access secrets. The scope is narrow and consistent with the stated purpose, but the instructions repeatedly assert '始终生效' (always in effect), giving broad behavioral influence.
Install Mechanism
No install spec included in registry; README suggests cloning from GitHub or using clawhub. No downloads, binaries, or extracted archives in the skill package — instruction-only, so low install risk. Verify the GitHub repo URL before cloning in case it points to an unexpected repository.
Credentials
The skill declares no required environment variables, credentials, or config paths. The instructions do not reference any secrets or unrelated environment variables.
Persistence & Privilege
SKILL.md front-matter and README declare 'alwaysLoad: true' and repeatedly state the skill should '始终生效' (always be in effect), but the registry metadata shows always: false. That discrepancy is noteworthy: if the runtime honors the skill's internal alwaysLoad indicator, the skill could be active for all agent interactions and thus influence behavior broadly. Always‑active skills are higher‑impact; confirm which source the platform trusts (registry metadata vs. skill file) before installing. Also check whether the skill writes decision logs or modifies gateway settings when installed.
What to consider before installing
This skill is primarily an instruction-only 'thinking' framework and requests no secrets — that's good. The main red flag is the inconsistency about being 'always active': SKILL.md and README assert alwaysLoad: true while registry metadata lists always: false. Before installing, (1) verify which value the platform enforces (registry metadata or the skill file), (2) inspect the skill folder after cloning to ensure there are no added code files or install scripts, (3) prefer installing from a trusted repository URL and check the GitHub repo contents, and (4) if you want limited scope, do not enable 'always' behavior or only enable the skill on demand. If you need higher assurance, ask the publisher to reconcile the always/alwaysLoad discrepancy or request a signed/official release.Like a lobster shell, security has layers — review code before you run it.
latestvk97dh4fpsqwpgd5gj6mjg8qets842cgp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.