Monitors ClawHub for skills gaining traction by tracking download and star growth, alerts on surges based on configurable thresholds.
Security Analysis
high confidenceThe skill's code and runtime instructions are consistent with its stated purpose (monitoring ClawHub trends), request only Node.js and local state files, and do not ask for unrelated credentials or privileged access.
Name/description say it monitors ClawHub for trending skills; code fetches from https://clawhub.ai/api/v1/skills, computes growth, scores relevance, and writes local state. Required binary is node — appropriate and proportionate.
SKILL.md directs running CLI commands, storing state under ~/.skill-surge-notifier, and optionally scheduling via cron. The runtime instructions only read/write those local files and call the ClawHub API; they do not access unrelated system paths or secrets.
No install spec (files are executed in-place). There are source files included but no external downloads or installers — low-risk execution model assuming you run it intentionally with Node 18+.
No required environment variables or credentials. Optional vars (SURGE_DIR, STATE_PATH, CONFIG_PATH, SCHEDULED) only control local paths/behavior. No evidence of requests for unrelated secrets or cloud credentials.
Does not request always:true or elevated privileges. It persists only its own state and config under the user's home directory. Agent-autonomous invocation is allowed by default but not combined with other risky behaviors.
Guidance
This skill appears to do exactly what it claims: query the ClawHub API, compute surges, and store local state under ~/.skill-surge-notifier. Before installing, ensure you run it with Node 18+ and are comfortable with it creating files in your home directory and making outbound requests to https://clawhub.ai. If you plan to schedule it (cron or agent heartbeat), be aware it will periodically fetch remote data; consider running in an environment with least privilege (or restrict network access) if you want stronger isolation. If you need higher assurance, review the included source files (fetch_trending.js and surge_check.js) yourself, or run the tool in a sandboxed container. Overall there are no obvious mismatches or secret-exfiltration behaviors in the bundle.
Latest Release
v1.0.0
Initial release of Skill Surge Notifier. - Monitors ClawHub for trending skills by tracking downloads and stars. - Alerts when a skill experiences significant surges, crosses thresholds, or enters the top 10. - Includes CLI commands for fetching stats, running surge checks, setting profiles, and configuring thresholds. - Supports environment variables for path and behavior overrides. - Outputs all information to stdout; designed to integrate with agents or run on a schedule.
Popular Skills
Published by @gabriel-kaufman on ClawHub
