SKILLEMALL.ai
GitHub ↗ RU Sign in

FC yc

CLI for YC Startup School, a16z Speedrun, SPC, and startup program discovery — weekly updates, dashboard, applications, accelerator deadlines

Not recommendedcritical or high security findings · low grade F
ClawHub Agent Skills author: lucasygu v0.3.2 17 files body ≈ 2 082 tokens Open the sourceclawhub.ai↗ analyzed 3 d ago

As a process C 63/100 · Has gaps — weak spots: result and completion, when it triggers, failures and branches

IntegrationInfrastructureData and analyticstype and topics are labelled automatically from the skill text
Runs in: OpenClaw Claude / Claude Code ChatGPT / Codex Gemini CLI Cursor GitHub Copilot / VS Code Qwen Code Kimi Code CLI Z.ai (GLM) DeepSeek (Deep Code) Mistral Vibe LangChain (deepagents) Goose OpenCode
JSON
Technical rating
F
28/100
safety, quality, tests
Safety 60%
0
Quality 40%
69
Run on models
none yet
Process rating
C
63/100
Has gaps
Result and completion w 14
0
Failures and branches w 10
0
When it triggers w 12
20
the three weakest of ten parameters · all ten

What is at stake

The skill contains fragments that, in the wrong hands, cost money or data. Below: what the installer risks and what the author should do.

Exfiltration
If you install

The instructions or scripts send data out: environment variables, keys, file contents, chat history. You may never notice, because the agent performs the upload as "part of the task".

For the author

If the upload is not needed for the task, remove it: catalogs flag such skills and delist them. If it is needed, name the destination explicitly, say what leaves the machine, and give the user a switch.

Broad scope medium severity

Below is the worst case for this category. The finding here is medium: the guard saw a sign, not a proof.

If you install

The skill asks for more than the task needs: broad tool access, credential environment variables, binaries. Every extra permission widens the damage from a mistake or a compromise.

For the author

Narrow allowed-tools and the variable list to the minimum; replace binaries with readable sources or scripts.

How to improve

  1. Address the high-severity findings: each costs 18 safety points. If one is a false positive, add the rule id to guard.allow in spec.yaml.
  2. Say in the description WHEN to use the skill ("use when…", example requests): that is the agent's main cue.
For the model run — optional
  • Your own cases (evals/evals.json, 4–6 real requests with expected answers): the full check would then run those instead of a model-drafted suite.
  • A spec.yaml with trigger phrases and assertions — a behaviour contract for CI; `skilltest init` writes a template.

Guard findings · 16

  • high Exfiltration intent-browser-credential-store README.md:27
    Accesses a browser credential / cookie store
    - **YC Startup School**: Uses cookies from your Chrome browser session — log into [startupschool.org](https://www.startupschool.org/) in Chrome first.
  • high Exfiltration intent-browser-credential-store README.md:257
    Accesses a browser credential / cookie store
    | YC Startup School | Chrome session cookies | Log into startupschool.org in Chrome |
  • high Exfiltration intent-browser-credential-store SKILL.md:275
    Accesses a browser credential / cookie store
    - **YC Startup School**: Extracts session cookies from Chrome — log in at startupschool.org first.
  • high Exfiltration intent-browser-credential-store src/cli.ts:67
    Accesses a browser credential / cookie store
    const cookies = await extractCookies(source, chromeProfile);
Medium and low: 12
  • medium Exfiltration intent-browser-credential-store README.md:110
    Accesses a browser credential / cookie store (detector / deny-list definition)
    | `--cookie-source <browser>` | Browser to read cookies from (chrome, safari, firefox) | `chrome` |
    detector
  • medium Exfiltration intent-browser-credential-store README.md:186
    Accesses a browser credential / cookie store (destination is a well-known publishing service)
    **YC Startup School** — Reads your session cookies from Chrome (via [@steipete/sweet-cookie](https://github.com/steipete/sweet-cookie)), extracts the Rails CSRF token, then uses GraphQL for reads (`/g
    known service
  • medium Broad scope meta-broad-allowed-tools SKILL.md:1
    Broad tool permissions pre-approved: Bash
    allowed-tools: Bash Read Write
  • medium Exfiltration intent-browser-credential-store SKILL.md:167
    Accesses a browser credential / cookie store (detector / deny-list definition)
    - `--cookie-source <browser>` — Browser to read cookies from (chrome, safari, firefox). Default: chrome
    detector
  • medium Exfiltration intent-browser-credential-store src/cli.ts:55
    Accesses a browser credential / cookie store (detector / deny-list definition)
    "Browser to read cookies from (chrome, safari, firefox)",
    detector
  • medium Exfiltration intent-browser-credential-store src/lib/cookies.ts:4
    Accesses a browser credential / cookie store (code comment)
    * Extracts YC session cookies from Chrome/Safari/Firefox
    comment
  • medium Exfiltration intent-browser-credential-store src/lib/cookies.ts:25
    Accesses a browser credential / cookie store (code comment)
    * Discover Chrome profiles from Local State file.
    comment
  • medium Exfiltration intent-browser-credential-store src/lib/cookies.ts:154
    Accesses a browser credential / cookie store (detector / deny-list definition)
    log(`Reading cookies from ${source}${chromeProfile ? ` (profile: ${chromeProfile})` : ""}...`);
    detector
  • medium Exfiltration intent-browser-credential-store src/lib/cookies.ts:178
    Accesses a browser credential / cookie store (quoted — discussed, not commanded)
    log("Reading cookies from Chrome (default profile)...");
    quoted
  • low Secrets in code secret-high-entropy-token package-lock.json:41
    High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
    "integrity": "sha5…ZiR+BeGu…dXd+qTiw==",
    detector
  • low Secrets in code secret-high-entropy-token package-lock.json:60
    High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
    "integrity": "sha5…uWm+fFRcIOgKBMiOBP+eXiy…9ab+DDKA==",
    detector
  • low Secrets in code secret-high-entropy-token package-lock.json:127
    High-entropy token-like string (may be an id, hash or a credential) (detector / deny-list definition)
    "integrity": "sha5…wQp+7C4n…9JQ==",
    detector

Files scanned: 17. Evidence is masked. Grey chips explain why severity was lowered.

Against the Agent Skills spec

  • warning description-no-when description does not say WHEN to use the skill (no "use when")

Process rating: all ten parameters 63/100

  • 0Result and completion. Does not say what the result is
  • 0Failures and branches. Linear process with no failure handling
  • 20When it triggers. No condition that starts the skill
  • 70Inputs and preconditions. Inputs and preconditions are listed
  • 100Tools and files. Tools declared in frontmatter
  • 100Steps. 19 steps
  • 100Consistency. Name and required fields are in place
  • 100Execution cost. Instruction body is 2082 tokens
  • 100Running it twice. No mutating operations
  • 100Progress reporting. Reports progress
  • low The response is described with custom markup (9 tags): a typed call is more reliable

Everything here is measured from the skill text rather than judged by a model, so the numbers are checkable. A parameter weighs more when it is a more common reason for the process to stall.

Quality signals

  • +5Description has no quoted example phrases that should trigger the skill
  • +4Description does not say when NOT to use the skill (false activations)
  • +3Output format is not stated: the model decides each time
  • -32 of 2 scripts are never mentioned in SKILL.md
  • +1No license
  • +2Single-language instructions
  • +3Description length 141: enough signal without eating the budget
  • +4Structure: 34 headings
  • +3Step-by-step instructions: 19 items
  • +4Has examples (14 code blocks)

Quality base 70; lint remarks subtract, signals add up to 100. Result: 69.

External checks

ClawHub: suspicious
This skill appears purpose-built for startup program automation, but it needs review because it reads live browser session cookies and can submit real applications/account updates with broad agent-driven control.
LLM: suspicious (high) · VirusTotal: · 29 May 2026