typeclaw-config
typeclaw-config is an API access & connector plumbing skill for AI agents, published by typeclaw in the typeclaw repository on GitHub. Skillspace rates typeclaw-config F (15/100) and the safety scan rated it unsafe; the rating is based on static analysis only.
Unsafe. This skill has patterns associated with malicious or dangerous behaviour. We do not recommend running it.
Read or edit typeclaw.json — the host-stage runtime config: model, port, mounts, plugins, alias, channels, portForward, docker.file (container package toggles + append), git.ignore.append, plus provider credentials (secrets.json/.env) and the allowed-models registry. Strict schema with a mix of live-reloadable and restart-required fields — load before touching the file or you risk corrupting it or promising a behavior the runtime won't deliver. Also the authority on what a field defaults to and whether a behavior is already on out of the box (port forwarding, container packages, model choice) — load before saying you don't know what X defaults to, or before proposing to add a field whose default the user is asking about; most fields already default to the expected behavior, so the answer is usually 'no edit needed'. Owns the GitHub channel config — which repos it watches (channels.github.repos), the code-review trigger (channels.github.review.on/approve), webhook auto-registration via…
- Grade
- F
- Quality
- 15 / 100
- Safety
- Unsafe
- GitHub stars
- 42
Unproven: rated by static analysis only, not yet compared head-to-head.
Our two independent classifiers differ on this skill's category, so treat the placement as provisional.
This rating describes the version of the repository we crawled; it may have changed since.
Our review
- Architecture
- 78 / 100
- Maturity
- Structured: ships references or scripts
- Security scan
- Critical-risk patterns
- License
- MIT
- Adoption
- Adopted by 0 other repositories, in 0 collections
What the scanner flagged
- destructive rm -rf on home/root
- pipe remote script to shell
- references sensitive credential env
- accesses sensitive system files
- reads environment variables
- suspicious outbound endpoint
- mentions secrets in text
Not checked yet
- Not judged on the rubric yet (not a contender in its category)
- No blind task eval yet
- Scope (portable / vendor / repo-internal) not assessed; only the top of each category is read for scope
- Sibling files (scripts, references) not fetched; security scan covers SKILL.md only
Skillspace indexes and rates this skill; it does not host or endorse it. Run third-party skills at your own risk.