Obscure Package Master

Use this skill if your uncertainty with a package's API is > 5% to create a deterministic, versioned mirror of the package repo with a built-in coordinate sy...

This tool appears coherent for creating local mirrors of Python packages, but take precautions before running it: - Review and sandbox: Inspect the generate_mirror.py source yourself (it's included). Prefer running it in an isolated environment (container, ephemeral VM, or a throwaway account) so its filesystem writes and network downloads can't affect important data. - Archive extraction risk: The script uses tarfile.extractall() and zipfile.extractall() without sanitizing paths—malicious or malformed archives could write files outside tmp_download. Don’t run it on untrusted packages without adding safe extraction checks. - Environment probing: The script checks many provider API key environment variables (OpenAI/Gemini/Anthropic/Copilot). It doesn't appear to send them anywhere, but it will observe them. If you’re uncomfortable, run with those env vars unset or in a restricted environment. - Network trust: The tool uses pip to download source distributions from PyPI. If you mirror packages you don’t control, ensure you trust the package/version (supply pinned versions you reviewed). Consider using an internal package proxy/mirror if you have one. - Check generated content: After running, inspect the newly created .skills/<package>-<version>/references and SKILL.md before allowing an agent to use them. Make sure no unexpected files were created and no existing skills were overwritten. If you want to use this skill, consider patching the script to implement safe archive extraction (sanitize file names), and to avoid scanning for provider API keys unless explicitly requested.

Type: OpenClaw Skill Name: obscure-package-master Version: 1.0.0 The skill bundle contains a script, `scripts/generate_mirror.py`, that automatically generates and installs new skills into sensitive, provider-specific directories (e.g., `~/.claude/skills`, `~/.openai/skills`). It determines these paths by inspecting environment variables for sensitive API keys (e.g., `ANTHROPIC_API_KEY`, `OPENAI_API_KEY`, `GEMINI_API_KEY`). While the stated goal is to provide grounded API references via AST parsing, the automated installation of third-party code and instructions into the agent's trusted environment functions as a persistence mechanism and increases the risk of executing malicious code downloaded from PyPI. The `SKILL.md` file provides instructions that encourage the agent to perform this self-expansion whenever it encounters API uncertainty.