Clipboard Knowledge Capture

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears coherent and low-risk: it structures clipboard text into local notes, with only disclosed local Python/file handling and warnings about sensitive content.

Before installing, confirm you are comfortable with a local Python helper processing specified input and optional output files. Use it for reviewable note drafts, not for saving plaintext secrets or sensitive clipboard contents.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

If used with shell access, the skill can process the input file and create an output file on the local machine.

Why it was flagged

The skill discloses optional execution of a bundled local Python helper. This is expected for generating structured output, but it still means the agent may run local code and read/write user-specified files.

Skill content

如运行环境允许 shell / exec，可使用：
   - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>`

Recommendation

Run it only on intended files, choose an output path you recognize, and review the generated Markdown before adding it to a knowledge base.

Low

#ASI06: Memory and Context Poisoning

What this means

Clipboard text may be retained in local notes; if the clipboard contains secrets, personal data, or confidential material, that content could be preserved unintentionally.

Why it was flagged

The core purpose is to turn clipboard snippets into local knowledge-base material, and the artifact explicitly warns against saving plaintext sensitive keys.

Skill content

把剪贴板片段沉淀到本地知识库... 不要保存敏感密钥明文

Recommendation

Redact secrets and personal or confidential details before capture, and keep source information so saved notes remain auditable.