Skill Readme Rebuilder

Security checks across malware telemetry and agentic risk

Overview

This looks like a purpose-aligned documentation helper, with the main thing to notice being that it can run a local Python script to read a chosen directory and write a report.

This skill appears safe for local README and documentation maintenance. Before installing or invoking it, make sure you are comfortable with a local Python script scanning the specific skill directory you provide, and write output to a new or disposable file if you do not want existing documentation changed.

VirusTotal

64/64 vendors flagged this skill as clean.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#
ASI02: Tool Misuse and Exploitation
Low
What this means

When used with shell access, the skill may run local code and write a local report file.

Why it was flagged

The skill explicitly permits invoking a bundled local Python helper with user-selected input and output paths. This is aligned with generating documentation, but users should ensure the paths are intentional.

Skill content
如运行环境允许 shell / exec,可使用:`python3 "{baseDir}/scripts/run.py" --input <输入文件> --output <输出文件>`
Recommendation

Run it only on the intended skill directory, choose a safe output path, and use review/dry-run-style workflows before adopting generated documentation.

#
ASI06: Memory and Context Poisoning
Low
What this means

If pointed at a broad or private folder, the generated report could include local project structure or document headings that were not meant to be shared.

Why it was flagged

The helper recursively samples text-like files from the provided directory and uses them to build the report, so local filenames and document headings can enter the generated output.

Skill content
for path in root.rglob("*") ... if path.suffix.lower() in {".md",".txt",".json",".yaml",".yml",".py",".js",".ts",".csv",".tsv",".sh"}: results.append(path)
Recommendation

Provide a narrow skill directory as input and avoid running it on home directories, broad repositories, or folders containing sensitive materials unless that is intended.