Data Retention Mapper

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent, local data-retention mapping helper that produces reviewable reports and does not show evidence of hidden networking, credential use, or destructive behavior.

This appears safe to install for local, reviewable data-retention mapping. Before use, remember that retention inventories can contain sensitive storage-location and privacy information, so provide only intended files or directories and review outputs before sharing them.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If invoked with the wrong file or output path, the local helper may read unintended local content or write a report where the user did not expect it.

Why it was flagged

The skill documents optional local command execution with user-provided input and output paths. This is disclosed and aligned with generating a retention report, but users should ensure paths are intentional.

Skill content

如运行环境允许 shell / exec，可使用：
   - `python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>`

Recommendation

Use explicit input files, avoid sensitive raw data when possible, and choose a safe output path; use review/dry-run style workflows for sensitive materials.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If a directory mode is used, the script may sample local text files from that directory tree for report generation.

Why it was flagged

The helper includes directory-scanning support with a limit when operating in directory-oriented modes. This is consistent with audit/report generation and is bounded, but directory inputs can expose more local file content than a single-file workflow.

Skill content

for path in root.rglob("*"):
        if len(results) >= limit:
            break
        if path.is_file():

Recommendation

Point the tool only at directories intended for review, keep the sample limit low, and avoid directories containing unrelated private material.