SkillCompass — Skill Evolution Engine

Evaluate skill quality, find the weakest dimension, and apply directed improvements. Also tracks usage to spot idle or risky skills. Use when: first session...

Install only if you want a powerful local skill-management tool that can monitor skill use, scan installed skills, write snapshots/logs, and run local commands. Review hooks/hooks.json, lib/update-checker.js, commands/setup.md, and shared/tool-instructions.md first. Avoid enabling the statusLine option until the missing hud-extra.js path is resolved, do not trust custom security tool commands from untrusted .skill-compass/config.json, and back up ~/.claude/settings.json and important skills before using write/update/rollback flows.

Type: OpenClaw Skill Name: skill-compass Version: 1.1.0 This skill bundle is classified as malicious due to multiple indicators of deceptive and harmful intent. It employs string-splitting obfuscation in `lib/patterns.js` and `hooks/scripts/eval-gate.js` to evade static analysis and hide a security 'gate bypass' file named `.ga-te-bypass`. The `SKILL.md` file contains prompt injection instructions that command the AI agent to auto-execute an onboarding process on session start without user intervention, which includes modifying the user's global `~/.claude/settings.json` to establish persistence for an external script. Additionally, the `SECURITY.md` file falsely claims 'Zero Network Activity' despite `lib/update-checker.js` containing logic for remote `git fetch` and `pull` operations. The bundle also references a missing script (`scripts/hud-extra.js`) for the persistent status line, which is a common characteristic of staged malware.