Skip to content
skillsafebeta
← Report library
Purpose / Other

Caveman Help Skill Security Audit

What the author says it does (original text)

>

Independent security check

No obvious risks found in this check

Files checked
2
Risks found
0
Could it run dangerous commands?Looks for programs run straight after downloading, remote control of your computer, and hidden commands.No risks found
Could it expose your files or keys?Looks for uploads of files containing passwords or keys, and keys written directly in the code.No risks found
Could it delete files or keep running?Looks for broad file deletion, disk overwrites, and programs set to start automatically.No risks found
Could it bypass safety checks?Looks for skipped website security checks, excessive file access, or actions that skip your approval.No risks found
Could it mislead the AI or hide text?Checks the skill instructions for requests to ignore you, influence the report, or hide text in invisible characters.No risks found
Could it change links or payment recipients without asking?Looks for forced referral or payment changes combined with instructions to hide the change.No risks found

Inside this skill

6 instruction sections

This Skill is a one-shot help card: when invoked, it displays reference information and explicitly forbids changing modes, writing flag files, or persisting anything. The provided files contain no scripts or automatic execution steps.

View source
SKILL.md:10In the instructionsOpen original file
Display this reference card when invoked. One-shot — do NOT change mode, write flag files, or persist anything. Output in caveman style.
README.md:7In the instructionsOpen original file
Prints a cheat sheet of all caveman modes, sibling skills, deactivation triggers, and how to set the default mode via env var or config file. One-shot display — does not flip the active mode, write flag files, or persist anything. Use when you forget the slash commands.

The help card documents an environment variable and configuration file that users may set themselves, explaining that they affect the default mode and automatic activation; this Skill does not instruct the agent to make those changes for the user.

View source
SKILL.md:46In the instructionsOpen original file
**Environment variable** (highest priority):```bashexport CAVEMAN_DEFAULT_MODE=ultra```
SKILL.md:51In the instructionsOpen original file
**Config file** (`~/.config/caveman/config.json`):```json{ "defaultMode": "lite" }```
SKILL.md:56In the instructionsOpen original file
Set `"off"` to disable auto-activation on session start. User can still activate manually with `/caveman`.Resolution: env var > config file > `full`.

The Skill requests output in the user's current language with a compressed writing style, while preserving code, commands, and exact error strings unless the user asks for translation.

View source
SKILL.md:40In the instructionsOpen original file
Keep user's language by default. User write Portuguese → reply Portuguese caveman. Compress the style, not the language. Technical terms, code, commands, commit types, and exact error strings stay verbatim unless user ask for translation.
Start here · InstructionsSKILL.md
caveman-help
Lines connect the instruction file to its sections, not an observed execution order. Select a section to read the source.

File reference map

References: 1
Files making referencesReferenced content
Lines show actual file references, not execution order. Select a node to highlight its connections and inspect the files and source locations. Dashed lines include files that still need locating.
Files and check records2 files

Coverage and gaps

Content covered in each file

These are the source ranges included in this check, not a guarantee that every issue has been resolved.

  • SKILL.mdFull text included
  • README.mdFull text included

This report is for the version above. We read the available code and instructions without running the skill or checking extra packages it installs. This is not a promise of safety: a different version or setup may behave differently.

  • README.mdSupporting file
  • SKILL.mdInstructions

Operations mentioned in code and instructions

Run commands
SKILL.md:47In the instructionsOpen original file
**Environment variable** (highest priority):```bashexport CAVEMAN_DEFAULT_MODE=ultra
Connect to websites
SKILL.md:62In the instructionsOpen original file
Full docs: https://github.com/JuliusBrussee/caveman
Lines read
102
File checksum (to compare versions)
81105bb7064a3728a421da0b61e453cd24a94f0f8dc76a8900915bb7d90df6f5