gl0di
- 208 skills
- 0 followers
- 6 hours ago last updated
- ▌ Quick Tool · gl0diA quick productivity tool with a Prerequisites section that instructs pasting a remote-fetch command into a terminal.
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Helper 3 · gl0di bundleA plain two-file skill with ordinary prose in each file — no base64, no split payload.
- ▌
- ▌ Loader 9 · gl0di bundleA general-purpose helper that reads and execs two locale string files whose names are not chunked/part-numbered -- leg 3 must not fire.
- ▌ Dispatcher · gl0di bundleReaches os.system via a computed attribute name built from string concatenation — a dynamic-dispatch sink obfuscation (B91 WARN).
- ▌ Net Fetcher · gl0di bundleFetches a remote resource via a shell pipeline. Declares no allowed-tools/tools manifest at all.
- ▌
- ▌
- ▌ Git Doctor · gl0diDiagnose local git configuration problems by showing the user their current settings.
- ▌
- ▌ Pkgskill 2 · gl0di bundleShips ordinary build/lint lifecycle scripts — no remote fetch or shell exec.
- ▌ Note Formatter · gl0di bundleA well-behaved skill that formats notes. Pinned deps, no suspicious names.
- ▌ Argvskill · gl0di bundleCaller input flows into a fixed-program subprocess argv list (shell=False) — argument injection only, not command injection. B13 FP regression guard.
- ▌ S 12 · gl0di bundleAssigns a hardcoded provider-shaped token to a module-level constant — B-740 fires.
- ▌ Memory Poisoner · gl0diA rogue skill that injects persistent instructions into the agent memory file.
- ▌
- ▌ Quick Tool 2 · gl0diA quick productivity tool with an ordinary pinned pip install line under Prerequisites — no remote-fetch, no paste-into-terminal imperative.
- ▌ Security Guide · gl0diA security skill that DOCUMENTS dangerous patterns as examples of what NOT to do.
- ▌
- ▌ K8S Ops · gl0di bundleManage Kubernetes pods and deployments from within the cluster using the mounted service-account credentials for in-cluster API access.
- ▌
- ▌
- ▌
- ▌ Reqskill · gl0di bundleDepends on the real 'requests' package, exactly pinned — no dependency-confusion risk.
- ▌ Text Tool · gl0di bundleFormats and trims plain text strings. No network, filesystem write, or exec effects, and no manifest field either — nothing risky to declare.
- ▌ Vendored Tool · gl0di bundleShips a vendored dependency directory with a plain path-only .pth file (no import line) — ordinary packaging, not auto-execution.
- ▌
- ▌ Quick Tool 3 · gl0diA quick productivity tool whose Setup section fetches an installer from a bare public-IP host, with no paste-into-terminal imperative wording (SC-001 IP corroborator).
- ▌ Split Skill · gl0di bundleShips two data files whose base64 content only decodes to a shell/download payload when joined across their file boundary.
- ▌
- ▌
- ▌ Reqskill 2 · gl0di bundleShips an unpinned dependency named 'reqeusts' — one edit away from the well-known 'requests' package (B95 WARN, dependency confusion).
- ▌ Vendored Tool 2 · gl0di bundleShips a vendored dependency directory containing an executable .pth file and a sitecustomize.py.
- ▌
- ▌ Loader 10 · gl0di bundleA general-purpose helper that runs a tiny hardcoded code-gen template inline via exec() -- a literal argument, nothing to trace.
- ▌
- ▌
- ▌ Loaderskill · gl0di bundleAdds its own absolute directory to sys.path (dirname(abspath(__file__))) to import bundled siblings. Not hijackable — the path is anchored to the skill's own install location, not a relative or writable one. B86 must PASS.
- ▌ Dispatcher 2 · gl0di bundleDispatches to a method on a plain handler object by name — ordinary dynamic dispatch, not sink obfuscation.
- ▌ Pinned Helper · gl0di bundleA well-behaved skill with pinned dependencies and no auto-approve directives.
- ▌
- ▌
- ▌ Evil Fetch Skill · gl0diA skill that directs the agent to fetch its instructions from an external URL.
- ▌
- ▌ Loader 11 · gl0di bundleLoads a payload assembled from three chunked part files and executes it with exec(); a second, unrelated helper reads two non-chunked docs fragments and never reaches exec() (B336 WARN, attributed to the correct helper).
- ▌
- ▌ Quick Tool 4 · gl0diBoundary case — a Setup section fetches an installer from a private/loopback IP host, with no paste-into-terminal imperative wording. Must stay PASS because the IP corroborator only fires on a PUBLIC IP literal.
- ▌ Redteam Glossary · gl0diA documentation/glossary skill that lists common red-team tool names for security education, with no offensive instructions.
- ▌
- ▌
- ▌
- ▌
- ▌ Fare Lookup · gl0di bundleLook up rail and coach fares, compare routes, and explain ticket restrictions.
- ▌ Meta Auditor · gl0diA documented meta-auditor skill that reads other skills' declared frontmatter metadata (name, description fields) from ~/.openclaw/skills/ to produce a compliance report. No executable code or secret values are read.
- ▌ Argvskill 2 · gl0di bundleCaller input flows into a fixed-program argv list that is built in a local before the call (cmd = [prog, arg]; subprocess.run(cmd)) — argument injection only, not command injection. B13 FP regression guard for the variable-bound argv form.
- ▌
- ▌ Loaderskill 2 · gl0di bundleExtends sys.path with a relative (CWD-relative) directory and imports from it. Anyone able to write ./plugins hijacks the skill's imports — an import-path hijack surface (B86 defensibility WARN).
- ▌ Cron Stdin Installer · gl0diA rogue skill that installs a recurring beacon job via crontab stdin install.
- ▌
- ▌
- ▌
- ▌ Loader 12 · gl0di bundleA general-purpose helper that reads and eval()'s two version-numbered locale string files (strings_v1.txt, strings_v2.txt) -- ordinary asset naming, not a chunked/part payload split -- leg 3 must not fire.
- ▌
- ▌ Benign Sink Skill · gl0diA skill that uses logging, temp files, and a report file — but with no credential data.
- ▌ Doc Example Skill · gl0diA skill whose documentation shows the anti-pattern inside a fenced code block.
- ▌
- ▌
- ▌ Envtools · gl0di bundleShips two scripts that compute a Python auto-execution persistence target at runtime and write/install it — the T06 (SkillTrustBench) blind spot B99's shipped-filename check cannot see.
- ▌ Self Evolver · gl0diA self-modifying skill that rewrites its own principles based on interactions, prose-only (no code).
- ▌ Quick Tool 5 · gl0diBoundary case — a remote-fetch install line under Prerequisites, but no paste-into-terminal imperative phrasing. B100 requires both signals together.
- ▌ Py Devenv · gl0diExplain and document Python developer environment conventions (REPL startup file, history, completion).
- ▌ Cve Advisory Summary · gl0diA skill that summarizes CVE advisories, quoting third-party reports that mention offensive tooling in reported-speech framing.
- ▌
- ▌
- ▌
- ▌
- ▌ Agent Todo · gl0di bundleTrack per-workspace todo items for each agent and sync them across sessions.
- ▌ With Lock Tool · gl0di bundleComputes a small value under a lock and a temp directory. No filesystem/network sink.
- ▌
- ▌ Tmpfile Cred Skill · gl0diA skill that writes SSH private key contents into a temporary file on the same line.
- ▌ Venvskill · gl0di bundleA helper function's own parameter happens to share a bare name with an unrelated, deterministic local variable in a completely different function. B-413 layer 1 regression guard for scope-bucketed taint tracking (cross-scope name collision, e.g. two functions both using "venv_dir"). Must not be a CRITICAL vet failure.
- ▌
- ▌
- ▌ Quick Tool 6 · gl0diA quick productivity tool whose body addresses the reviewer directly and attempts to forge the judge subagent's own delimiter framing.
- ▌
- ▌ API Docs · gl0di bundleAnswer questions about this repository's public API surface using a locally generated index.
- ▌
- ▌
- ▌
- ▌
- ▌ Loader 13 · gl0di bundleGenerates model source from two non-chunked template fragments (exec'd) and separately reads a schema index sharded into two genuinely chunked data files (never exec'd) -- B336 must attribute leg 3 to the feeding helper only.
- ▌
- ▌
- ▌
- ▌ Remote Shell Helper · gl0diSet up a temporary remote shell so a teammate can help debug this machine.