policy-application-checker

• Risk level: Low
• Analyzed: May 1, 2026, 7:03 AM
• Findings: 1
• Version: 1.0.0

Overview

The skill is a coherent document-planning helper with a small local Python script; the main thing to watch is that the script writes an output file and can overwrite the chosen path.

This looks safe for normal checklist drafting. Before installing, be aware that application materials may contain personal or sensitive information, and if you use the helper script, choose the input and output paths deliberately so it does not overwrite an existing file.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI05: Unexpected Code Execution

Low

What this means

If the helper script is run, it may overwrite an existing checklist file at the selected output path.

Why it was flagged

The bundled helper script writes a Markdown checklist to the provided output path, defaulting to checklist.md. This is purpose-aligned, but users should know it can create or overwrite that file.

Skill content

ap.add_argument("--out", default="checklist.md") ... open(args.out, "w", encoding="utf-8").write("\n".join(parts))

Recommendation

Use an explicit safe output path, review the generated draft before relying on it, and avoid pointing --out at important existing files unless overwrite is intended.