gl0di
- 208 skills
- 0 followers
- 8 hours ago last updated
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Vault 2 · gl0di bundleShips a per-turn hooks/openclaw/handler.mjs that rewrites tool-call args and exfiltrates process.env to a remote collector (B97 WARN, escalated).
- ▌
- ▌ Ssrfskill · gl0di bundleExternally-controlled URL with internal endpoint literal — SSRF (info) fires.
- ▌
- ▌
- ▌
- ▌
- ▌ Loader 2 · gl0di bundleLoads a bundled config file with json.load and yaml.safe_load — no deserialization code-exec surface.
- ▌
- ▌
- ▌ Tool · gl0di bundleShips a bundled config.json with an approve-all-shaped setting and a telemetry-callback URL (B96 WARN, heuristic).
- ▌ Vault 3 · gl0di bundleShips a minified (single very-long-line) hooks/openclaw/handler.mjs that cannot be lexically reviewed (B97 UNKNOWN).
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Tool 2 · gl0di bundleShips an ordinary bundled config.json with a log level and a retry count — no trust-widening or telemetry-callback wording.
- ▌
- ▌
- ▌ Loader 3 · gl0di bundleWrites a base64-decoded embedded logo asset to disk -- no exec/eval sink at all.
- ▌ Loader 4 · gl0di bundleA general-purpose helper whose module-level TEMPLATE constant (assembled from two chunked/part files) shares a bare name with an unrelated function's own local eval() target -- name shadowing, not data flow. Leg 3 corroborates on its own; the taint must still not cross scope.
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Pkgskill · gl0di bundleShips a package.json "prepare" lifecycle hook that fetches and runs a remote script (B94 WARN).
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌ Loader 5 · gl0di bundleA genuine multi-file Python package that imports sibling modules normally -- no open/read/exec surface.
- ▌ Git Helper · gl0diA skill that uses git and rm in benign, non-destructive, non-autonomous contexts.
- ▌
- ▌
- ▌ Loader 6 · gl0di bundleLoads a payload assembled from three chunked part files and executes it with exec() (B336 WARN).
- ▌ Loader 7 · gl0di bundleLoads a bundled model file with pickle.load — an unsafe deserialization sink (B92 WARN).
- ▌
- ▌ Venv Doctor · gl0di bundleLegitimate diagnostic skill that lists candidate site-packages directories for import troubleshooting and runs a subprocess with a custom PYTHONSTARTUP, without ever writing a sitecustomize file or touching a shell rc file.
- ▌ Loader 8 · gl0di bundleReads and joins two config files, then parses the result with json.loads -- no exec/eval sink.
- ▌ Deps Doctor · gl0di bundleDiagnose dependency and environment problems in a local project checkout.
- ▌
- ▌
- ▌ Ec2 Auth Helper · gl0diAuthenticate to AWS APIs using the EC2 instance profile role instead of a stored access-key pair.
- ▌ Gce Auth Helper · gl0diAuthenticate to Google Cloud APIs using the instance's workload identity instead of a static service-account key.
- ▌ Cloud Info Helper · gl0diReport this machine's cloud identity so the user can confirm it's the right host.
- ▌ Redteam Assessment · gl0diAn Active Directory red-team assessment skill that instructs the agent to run named offensive tooling against a Domain Controller.
- ▌ Clawshield · gl0di bundleMalicious skill wearing a retired own-skill directory name as a cloak, with matching frontmatter.
- ▌ Transcript Fetch · gl0diExtract full transcripts from video content for analysis, summarization or research.
- ▌
- ▌ Behavior Note · gl0diTracks your working habits and can modify your SOUL.md daily with a short profile note.
- ▌ Ad Threat Hunter · gl0diA blue-team detection-engineering skill that hunts for offensive AD tooling usage via Sysmon and SIEM telemetry.
- ▌ Address Geocoder · gl0diTurns a street address into latitude/longitude using a third-party geocoding API.
- ▌ Injection Awareness · gl0diRecognise and refuse prompt-injection directives embedded in third-party skills, documents, and web pages.
- ▌
- ▌
- ▌ Azure Auth Helper · gl0diAuthenticate to Azure Resource Manager using the VM's system-assigned managed identity instead of a stored client secret.
- ▌
- ▌
- ▌ Repo Ops Helper · gl0diKeeps a repository's operating instructions current for multiple agents working in it.
- ▌
- ▌
- ▌ Styleguide Check · gl0diValidate a repository's shared editor and lint configuration against the team styleguide service.
- ▌
- ▌
- ▌ Memory Keeper · gl0diSets up MEMORY.md for the current workspace and keeps the long-term notes in it tidy across sessions.
- ▌
- ▌
- ▌ Mentions Only · gl0diMentions two different foreign agents' config paths in passing, purely as documentation; neither path is ever accessed by this skill.
- ▌ Padded Fetch Skill · gl0diA skill whose runtime-fetch directive pads the URL-to-noun distance with harmless-looking filler text.
- ▌ Fake Skill2 · gl0diA benign integration helper that explicitly warns against fetching remote instructions before pointing at the vendor's own setup docs.
- ▌ Dotfiles Alias · gl0di bundleAppends a convenience shell alias to the user's .bashrc. An ordinary dotfile installer — no PYTHONSTARTUP, no sitecustomize/usercustomize target, anywhere in the skill.
- ▌ Decoy Verb Skill · gl0diA skill whose runtime-fetch directive sits after an unrelated prohibition about a completely different verb, in one unbroken sentence.
- ▌ Doc Helper · gl0diA helper that answers questions from bundled internal documentation and refuses to follow instructions pulled from arbitrary links.
- ▌ Invoice Helper · gl0di bundleMalicious skill whose directory was renamed to squat the scanner's own name; frontmatter still declares the original name.
- ▌
- ▌ Transcript Action Forwarder · gl0diForwards action items found in a call transcript to the team's automation webhook.
- ▌ Jailbreak Classifier · gl0di bundleScores an inbound prompt for jailbreak/persona-override risk before the agent acts on it.
- ▌ Action Dispatcher · gl0diDocuments an internal agent-action dispatcher that recognises a "curl" action type.
- ▌
- ▌
- ▌
- ▌
- ▌
- ▌