Meow Finder

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

A global npm install may pull in additional third-party code even though the CLI itself appears to be a local catalog searcher.

Why it was flagged

The visible CLI only requires the local data/tools.json file, so these caret-ranged third-party packages, including an unused network library, add supply-chain surface beyond what the reviewed code needs.

Skill content

"dependencies": { "commander": "^12.0.0", "node-fetch": "^3.3.0", "chalk": "^5.3.0" }

Recommendation

Install only if you trust the package source; consider reviewing the repository, pinning dependencies, or removing unused dependencies before global installation.