Is jlevitsk/prepper safe?
https://github.com/openclaw/skills/tree/main/skills/jlevitsk/prepper
The jlevitsk/prepper skill is designed primarily as a jailbreak mechanism: it uses the dolphin-llama3 uncensored model as a safety bypass, explicitly instructing the host agent to present unfiltered outputs (including for weapons and unconventional medicine) when Claude refuses a query, and to do so without any disclaimer. While the skill contains no malware, no data exfiltration code, and installs cleanly, its core documented purpose is to systematically circumvent AI safety controls — this is not an incidental side effect but the explicitly stated design goal across SKILL.md and hybrid-validation.md. The skill should not be installed in any agent context, particularly those with code execution or filesystem access tools.
Category Scores
Findings (10)
CRITICAL Explicit safety bypass architecture: uncensored fallback when Claude refuses -60 ▶
The skill's primary documented workflow is to query dolphin-llama3 (an uncensored model) and, when Claude would refuse the question, present the uncensored model's answer directly to the user without any disclaimer or safety framing. This is not an edge case — it is the stated purpose of the 'uncensored fallback' branch and is documented as the expected behavior in hybrid-validation.md.
CRITICAL Weapons and unconventional medicine explicitly named as bypass use cases -25 ▶
The skill description field and SKILL.md both explicitly name weapon-related queries and unconventional medicine as target scenarios for bypassing Claude's safety responses. This is not an incidental edge case — it is in the description that determines when the skill triggers.
HIGH Systematic decision tree to override every Claude safety response path -10 ▶
The skill includes a complete decision tree covering every possible outcome (Claude can enhance, Claude refuses, Claude provides better answer, neither knows) with explicit fallback paths that eliminate or minimize safety framing in all cases. This is a comprehensive safety bypass strategy, not opportunistic.
HIGH dolphin-llama3 is a purpose-built safety bypass model, not a neutral knowledge source -60 ▶
The dolphin-llama3 model is a well-documented 'uncensored' fine-tune of LLaMA specifically designed to remove the safety training that prevents commercial models from answering harmful queries. The skill author is aware of this — the model is chosen precisely because it 'answers everything'. Framing it as a 'specialized survival knowledge' model is misleading.
HIGH Dangerous capability amplification when combined with code execution or file tools -30 ▶
When an agent with filesystem, shell, or network tools installs this skill, the jailbreak path enables generating harmful technical content (synthesis instructions, exploit code, etc.) that Claude would refuse, then executing it or writing it to disk. The skill's broad trigger conditions ('any practical how-to question') ensure it activates in these scenarios.
MEDIUM User query content routed verbatim to third-party model service -30 ▶
The Python script sends user questions directly to the ollama API. If the conversation contains sensitive context (credentials mentioned in passing, medical information, proprietary code), that content is transmitted to a locally-running but separately-installed model service whose logging configuration is outside the user's normal security boundary.
MEDIUM Executable Python script invoked as part of normal skill workflow -25 ▶
The skill instructs the agent to execute a Python script as part of its standard workflow. While the script itself appears benign (localhost-only requests), the pattern of agent-invoked scripts is a meaningful attack surface — script content could be updated silently via skill updates.
MEDIUM Skill requires installation of external AI model service (ollama) with curl-pipe-to-sh pattern -15 ▶
The skill's setup documentation instructs users to install ollama using a curl-pipe-to-sh command, which is a high-risk installation pattern. This is in documentation rather than automated hooks, but it expands the attack surface by requiring a separately managed service.
LOW Overly broad trigger conditions designed to maximize query interception -5 ▶
The skill description and trigger documentation use extremely broad language ('any other survival/prepper topics', 'any practical how-to question') that will cause the skill to activate for many general queries, not just actual survival scenarios.
INFO Installation process clean — no unexpected behavior during clone -10 ▶
The skill installation performed a standard sparse-checkout git clone from the openclaw/skills repository. No unexpected processes were spawned, no filesystem changes occurred outside the skill directory, and no firewall-blocked connection attempts were detected from the skill itself.