Quick system diagnostics: CPU, memory, disk, uptime
Security Analysis
medium confidenceThe skill's stated purpose (show system diagnostics) is plausible and low-risk, but the SKILL.md is internally inconsistent: it references a 'system-info' CLI that is not provided and lists only the 'free' binary though other utilities would be needed — the skill is incomplete or mis-documented.
Name/description match a simple system diagnostics tool, and requesting 'free' for memory is reasonable. However the SKILL.md shows usage of a 'system-info' command (and subcommands) that this skill does not install or provide. Also CPU/disk/uptime outputs normally require other utilities (e.g., lscpu, df, uptime) or explicit commands; requesting only 'free' is insufficient. This mismatch suggests the skill is incomplete or incorrectly declared.
The instructions are minimal and do not direct the agent to read unrelated files or exfiltrate data. However they are vague: they show CLI usage for a 'system-info' command but do not show the actual commands to run (e.g., which binaries to invoke and with what flags). That leaves ambiguous behavior — the agent or user would need to know what 'system-info' actually does.
No install spec and no code files — lowest-risk category. Nothing will be written to disk by an installer because there's no installer declared.
The skill requests no environment variables, credentials, or config paths. Its declared requirements (only 'free') are minimal — though likely incomplete for the claimed functionality (see purpose_capability).
always is false and the skill does not request persistent privileges or modify other skills. Autonomous invocation is enabled by default but not by itself a concern here.
Guidance
This skill looks harmless in intent (it only needs to read basic system info) but it's incomplete: SKILL.md shows a 'system-info' command that the skill does not install or document, and it only declares the 'free' binary while CPU, disk, and uptime typically need other utilities. Before installing or enabling it, ask the publisher to clarify: provide the implementation or the exact shell commands the skill will run, add any other required binaries (e.g., df, uptime, lscpu), or correct the documentation. If you enable the skill as-is, it likely won't work; because it requests no secrets or installs code, it isn't high-risk, but it's not trustworthy or useful until the mismatch is resolved.
Latest Release
v1.0.0
Initial publish
More by @Xejrax
Published by @Xejrax on ClawHub
