Is abrahamventura/roofing-knowledge-mentor safe?
https://github.com/openclaw/skills/tree/main/skills/abrahamventura/roofing-knowledge-mentor
Roofing Knowledge Mentor is a well-structured, narrowly-scoped domain knowledge skill consisting entirely of professional markdown content (SKILL.md plus six roofing-domain reference documents) and a benign Python structural validator. No prompt injection patterns, data exfiltration mechanisms, suspicious executable code, unexpected network behavior, or canary file compromise were detected at any layer of analysis. The skill's reference file-loading design is transparent, bounded to its own directory, and consistent with standard reference-augmented skill architecture.
Category Scores
Findings (4)
INFO Intent-driven local reference file loading -3 ▶
The SKILL.md intent-routing section instructs the agent to load one of six local markdown files (e.g., references/measurement-reasoning.md) based on query classification. The paths are hardcoded relative paths within the skill's own references/ directory. There is no user-controlled path interpolation and no instruction to load files from arbitrary locations. This is standard design for reference-augmented skills but is noted as it expands the agent's filesystem read activity during skill invocation.
INFO Bundled Python validation script -5 ▶
The skill includes scripts/quick_validate.py, a self-contained structural validator for checking SKILL.md frontmatter and directory conventions. Static analysis confirms: imports are os, re, sys, pathlib.Path, and typing only; no subprocess, socket, urllib, requests, or similar modules; no exec/eval/compile calls; no file writes; reads only within the skill root. The script was not executed during the audit (no corresponding EXECVE event for python3 against this path).
INFO Monorepo sparse-checkout via HTTPS to GitHub -5 ▶
Installation performed a shallow clone of the openclaw/skills monorepo (depth 1, no-checkout), then used git sparse-checkout to extract only the target skill path before copying to the execution directory and removing the clone. This is a legitimate multi-skill monorepo pattern. The substantial TCP download volume (~several hundred KB) is consistent with fetching a git pack for a large monorepo even with shallow clone flags.
INFO Canary file reads attributed to audit framework 0 ▶
Filesystem open/access events for all six honeypot credential files were observed at two points: timestamp 1771654518 (approximately 6 seconds before the git clone began) and timestamp 1771654540 (after all skill file analysis completed). Both windows align precisely with the audit system's pre-install baseline capture and post-install integrity verification phases respectively. No skill-originated process (no EXECVE for python3, bash, or any skill script) accessed these paths. Canary integrity confirmed intact by the audit platform.