RUNE Prompt Amplification

Transforms any flat prompt into a structured 8-layer XML prompt using RUNE's semantic engine — delivering ~45% higher quality AI responses. Built on Spinoza'...

Do not install or run this skill until you verify a few things: 1) Confirm which repository is authoritative (neurabytelabs vs mrsarac) and review the wand.py source in that repo — look for network calls, code that reads arbitrary files, or that sends environment variables/contents elsewhere. 2) Do not blindly append your API key into ~/.secrets; storing multiple secrets in a shared plain-text file increases exposure. Prefer exporting RUNE_API_KEY only in the current shell or using a dedicated, tightly-scoped secret file. 3) Inspect package.json and SKILL.md inconsistencies; if metadata supplied to the registry says no env are needed but runtime instructions do, treat that as a red flag. 4) If you must test, run the skill in an isolated environment (VM/container) and audit network traffic to confirm wand.py only communicates with expected endpoints. 5) If you are not comfortable reviewing wand.py or the cloned repo, avoid installing the skill.

Type: OpenClaw Skill Name: rune-prompt-amplification Version: 1.0.0 The skill is classified as suspicious due to a critical shell injection vulnerability and a supply chain risk. The `main.sh` script sources `$HOME/.secrets` without validating its content, allowing arbitrary code execution if an attacker can control this file. Additionally, the `SKILL.md` setup instructions direct users to clone `https://github.com/mrsarac/master-prompts` into the RUNE directory, which is inconsistent with the `neurabytelabs/rune` repository mentioned in `package.json` and `README.md`, posing a potential supply chain risk from an unexpected source.