Security audit
Security checks for vulnerabilities and agentic risk
ClawScan marked this skill benign because the reported network access and deadline-check behavior appear related to its purpose, though some concerns and incomplete inspection keep confidence medium.
Consider that the scan was partial: it inspected 4 of 5 components, and static analysis of one file was incomplete. Before installing, check that you are comfortable with its GitHub API access, unclear tool scope, and possible mismatch between commit age and push activity.
Without declared permissions the skill's intent is opaque and cannot be validated.
Data is being sent to an external URL. This could be legitimate telemetry or data exfiltration. Manual review is recommended.
const repo = spec.slice("github:".length);
if (!/^[\w.-]+\/[\w.-]+$/.test(repo)) return { kind: "github", error: "invalid github:owner/repo" };
try {
const res = await fetch(`https://api.github.com/repos/${repo}/commits?per_page=1%60, {
headers: { Accept: "application/vnd.github+json", "User-Agent": "deadline-radar" },
signal: AbortSignal.timeout(10000),
});
L061-L068 fetch the latest commit and label its committer timestamp as lastPushAt, although a commit timestamp does not record when it was pushed to GitHub. Consequently, the risk assessment can report stale push activity immediately after older commits are pushed, undermining the manifest's promised push-based deadline check.
"Am I on track" is common in conversations about fitness, finances, learning, and other topics unrelated to repository deadlines. Although the description explains the skill's purpose, it does not restrict this trigger to requests about DEADLINES.md or repository-linked deadlines.