SkillBench

Track skill versions, benchmark performance, compare improvements, and get self-improvement signals. Integrates with tasktime and ClawVault.

This skill appears to be a legitimate benchmarking CLI, but there are several red flags you should address before installing: 1) npm packages run code on install and at runtime — review the package source (GitHub repo) and the published package content before running npm install globally; 2) SKILL.md references the tasktime 'tt' CLI and external services (ClawVault/ClawHub) but the manifest doesn't declare those dependencies or any auth variables — verify how the CLI obtains credentials and ensure it won't read unexpected config files or exfiltrate data; 3) Prefer to install and test this tool in an isolated environment (container or VM) first, inspect what network endpoints it contacts, and check what files/dirs it writes; 4) If you plan to give it access to service tokens, issue scoped tokens with minimal privileges and rotate them after testing; 5) If you need help auditing the npm package contents or confirming the CLI's network behavior, provide the package URL or the package tarball and I can help review it. Proceed with caution.

Type: OpenClaw Skill Name: skillbench Version: 2.0.0 The skill is designed for benchmarking and monitoring AI agent performance, which involves syncing data to external services (ClawVault, ClawHub) and generating cron configurations for automated testing. While these actions are explicitly stated as part of the skill's purpose and do not show clear malicious intent, the capabilities to perform network communication to external endpoints (e.g., `skillbench sync --vault` to clawvault.dev) and to generate system-level automation (e.g., `skillbench schedule` for cron jobs) are considered high-risk behaviors. These capabilities, even if intended for benign use, could be exploited or lead to unintended consequences, warranting a 'suspicious' classification.