by 安全扫描
OpenClaw
安全
high confidenceThe skill's requirements and runtime instructions are internally consistent with its stated purpose (generate GPU kernels via an external MCP service), but it will read and modify local agent config and ask you to provide/store an MCP JWT so review those actions before proceeding.
评估建议
This skill appears coherent: it inspects your repository, runs environment checks, and delegates all code generation to an external kernelgen MCP service (it will not auto-generate kernel code locally). Before installing/using it, consider the following:
- The skill will ask you to provide an MCP service URL and a JWT token and will write/merge them into .claude/settings.json in the project. Only provide a token you trust and review the exact JSON the skill will write. Avoid pasting long-lived ...详细分析 ▾
✓ 用途与能力
The skill claims to generate GPU kernels and to route to three specialized workflows; its instructions require repository inspection, environment checks, and calls to an external kernelgen MCP service. All requested capabilities (Read/Write/Edit/Glob/Grep/Bash and MCP tools) are reasonable for this purpose.
ℹ 指令范围
Instructions are detailed and stay within the stated workflow (detect repo type, run environment checks, invoke MCP, adapt returned code, submit feedback). They do read repository files and run diagnostic shell commands (e.g., Python imports, nvidia-smi), and the feedback sub-skill will attempt to auto-collect environment info. The only notable scope extension is explicit editing of the project agent config file (.claude/settings.json) to add MCP credentials — this is necessary to enable the MCP but is a privileged write that persists sensitive data.
✓ 安装机制
This is an instruction-only skill with no install spec or downloaded code. It instructs using existing tools (pip, gh) when needed. No remote archive downloads or external install scripts are present in the package itself.
ℹ 凭证需求
The skill does not declare required environment variables, but it asks the user to supply an external MCP URL and JWT token and will write them into .claude/settings.json. It also performs runtime environment probes (torch/triton presence, CUDA, nvidia-smi) and may request package installs (with user consent for torch). Requesting and storing the MCP JWT is functionally necessary but sensitive — the token grants the MCP access to calls the skill will send (which may include code and repo context).
⚠ 持久化与权限
The skill instructs the agent to write/merge the MCP configuration (including a JWT) into .claude/settings.json in the project. This is a persistent, privileged modification of agent configuration and stores secrets locally; the action is justified by the skill's need to call the MCP but increases persistence and blast radius if the MCP or token is untrusted. always:false and autonomous invocation are normal and not set to escalate privileges.
安全有层次，运行前请审查代码。
运行时依赖
无特殊依赖
版本
latestv1.0.02026/3/23
- Initial release of kernelgen-flagos as a unified GPU kernel operator generation skill. - Automatically detects repository type (FlagGems, vLLM, or general Python/Triton) and dispatches to the appropriate specialized workflow. - Combines four sub-skills: kernelgen-general, kernelgen-for-flaggems, kernelgen-for-vllm, and kernelgen-submit-feedback, removing the need for separate installations. - Enforces mandatory use of the MCP tool for all operator code generation. - Supports user-invoked feedback and bug report submission via the bundled feedback sub-skill. - Enhances user experience with clear routing, explicit detection rules, and a quick reference guide.
● 无害
安装命令
点击复制官方npx clawhub@latest install kernelgen-flagos
镜像加速npx clawhub@latest install kernelgen-flagos --registry https://cn.longxiaskill.com