Is alexunitario-sketch/prompt-assemble safe?
https://github.com/openclaw/skills/tree/main/skills/alexunitario-sketch/prompt-assemble
This skill is a benign prompt engineering framework that provides token-safe prompt assembly patterns with memory orchestration. All code is pure string manipulation with no filesystem access, network calls, or privilege escalation. Installation monitoring detected no suspicious behavior — only standard GitHub clone traffic and system service activity.
Category Scores
Findings (3)
INFO Executable Python script with test runner -10 ▶
prompt_assemble.py includes a shebang line (#!/usr/bin/env python3) and a main block that runs unit tests for the PromptAssembler class. The tests are benign: they verify type handling, safety valve triggering, memory trigger detection, empty/None input handling, and memory summarization. No malicious operations in the test code.
INFO Skill provides prompt construction guidance -5 ▶
The skill's purpose is to teach agents how to build LLM prompts with memory management. While this means it influences prompt construction, this is the stated and legitimate purpose. The guidance is defensive in nature (preventing token overflow, safety valves) rather than offensive. No hidden instructions or injection patterns found.
INFO Lock file references external skill -5 ▶
The .clawhub/lock.json references 'academic-research-hub' as an installed skill dependency. This is metadata only and does not affect the security posture of this skill. No code from the referenced skill is included or executed.