Agent Directory

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A linked service's skill file could ask the agent to take actions outside this directory skill's own scope.

Why it was flagged

The skill's core workflow depends on remote third-party skill.md files. That is coherent with a directory service, but users should review those remote files before allowing an agent to act on them.

Skill content
2. **Learn** — Fetch the skill.md for services you need
3. **Use** — Follow the skill.md to integrate
Recommendation

Treat fetched skill.md files as separate, untrusted artifacts; review their permissions, credentials, and actions before installing or following them.

What this means

Users may have less clarity about which exact version of the instructions they are reviewing.

Why it was flagged

The registry metadata lists version 1.2.0 while the SKILL.md frontmatter lists 1.1.0. This is a minor provenance/coherence mismatch, not evidence of malicious behavior.

Skill content
version: 1.1.0
Recommendation

Confirm the published package version matches the SKILL.md version in future releases.