Coding Custom

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a local-only coding preference memory skill, with low-risk notes about persistent memory, metadata mismatch, and one ambiguous self-update reference.

This skill is reasonable to install if you want local coding-style memory. Before using it, confirm that it only writes to ~/coding/memory.md or ~/coding/history.md, review saved preferences periodically, and verify the registry/package identity mismatch.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Saved preferences may continue shaping generated code until the user reviews or removes them.

Why it was flagged

The skill intentionally persists coding preferences and reuses them in future sessions; this is purpose-aligned, but stale or mistaken entries can affect later code output.

Skill content
1. Load `~/coding/memory.md` if exists
2. Apply stored preferences to responses
Recommendation

Review ~/coding/memory.md occasionally and use the documented forget/remove behavior for entries that are wrong or no longer desired.

What this means

An agent could misunderstand where preferences should be stored if it follows the auxiliary wording too literally.

Why it was flagged

This auxiliary file mentions updating SKILL.md, which conflicts with the main SKILL.md statement that the skill never modifies its own SKILL.md. No automatic code path is shown, but the wording could confuse the intended persistence boundary.

Skill content
Reference only — consult when deciding whether to update SKILL.md.
Recommendation

Treat ~/coding/memory.md and ~/coding/history.md as the only writable memory files; do not allow the skill to edit its own SKILL.md.

What this means

The displayed registry identity may not perfectly match the packaged skill identity, which can make updates or publisher verification less clear.

Why it was flagged

The registry metadata differs from the packaged files, which identify the skill as slug `coding`, version `1.0.3`, with a different owner ID in _meta.json. This is a provenance/version consistency issue, not evidence of malicious behavior.

Skill content
Name: Coding Custom ... Slug: coding-custom ... Version: 1.0.0
Recommendation

Verify the publisher, slug, and version before installing or syncing the skill.