Setup & Installation
Or with the ClawHub CLI, for registry-managed skill folders outside a full OpenClaw workspace:
Version History
Scoring improvements: (1) New-repo hard caps now scale with hygiene signals — repos with tests, CI, license, security policy, docs can break through the 55 cap. (2) Suspicious account penalty reduced when repo has strong hygiene (4+ signals). (3) High commit frequency warning disabled for repos <7 days old. (4) Agent safety PASS raises cap ceiling for new repos. (5) Added crypto/DeFi domain allowlist: DEX APIs (DexScreener, Jupiter, Uniswap, Raydium, etc), launchpads (Virtuals, Clanker, Bankr, pump.fun, Doppler, Flaunch), social proxies (fxtwitter, nitter), sports data (ESPN, NBA), odds APIs, and funding links (Patreon, OpenCollective).
What This Skill Does
Analyzes GitHub repositories across 14 scoring categories and produces a trust score out of 100. Covers commit health, dependency audits, AI-generated code detection, crypto rug patterns, and agent safety checks. Also extracts and analyzes GitHub links found inside X/Twitter URLs.
Running 14 scoring categories in a single zero-dependency script replaces manually checking stars, CI config, commit history, and secrets across separate tools.
When to use it
- Checking if a new DeFi project's repo is legitimate before investing
- Auditing a dependency for malicious packages or install hooks
- Batch scanning multiple repos from a crypto project shortlist
- Extracting and scoring GitHub repos linked in a tweet
- Verifying contributor diversity and bus factor on an open-source tool
Example Workflow
Here's how your AI assistant might use this skill in practice.
User asks: analyze this tweet https://x.com/someuser/status/123 and tell me if the project is legit
- 1Extracts the GitHub URL embedded in the tweet
- 2Runs node scripts/analyze.js with the extracted repo and GITHUB_TOKEN loaded
- 3Scores the repo across 14 categories including crypto safety and agent safety
- 4Checks for rug patterns, hardcoded secrets, and suspicious dependency hooks
- 5Returns the grade, score, and notable flags in a concise summary
ProjectName: 62/100 [C] — 3 contributors, no GPG sigs, mint function detected, 1 hardcoded API key found in src/config.js. Agent safety: CAUTION.
Requirements
Accounts, API keys, or tools you or your AI assistant may need to set up while using this skill.