Security Skill Scanner
PassAudited by ClawScan on May 10, 2026.
Overview
This appears to be a read-only security scanner, with the main caution that its optional CLI can recursively read user-selected skill/code directories.
This skill looks safe for its stated purpose. Before installing or running the optional CLI, verify the package source, scan only the skill files or directories you intend to inspect, and treat the scanner’s regex-based findings as prompts for manual review rather than definitive security verdicts.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used on a broad directory, the scanner may read many local skill or code files and include matched snippets in its report.
The scanner recursively reads files under a user-supplied directory. This is expected for a security scanner, but users should avoid pointing it at broad or unrelated private directories.
if (stats.isDirectory()) { return this.scanDirectory(filePath); } ... if (file.endsWith('.md') || file.endsWith('.js') || file.endsWith('.ts'))Scan only the specific SKILL.md file or skill directory you intend to review, and review generated reports before sharing them.
Running the optional CLI executes local JavaScript from this package on your machine.
The package documents optional local Node.js execution. It is disclosed and user-directed, with no install-time execution shown in the artifacts.
The included `scanner.js` file can also be run directly with Node.js 18+ ... `node scanner.js path/to/SKILL.md`
Only run the CLI after verifying the package source, and prefer scanning a copied target file or narrow directory.
Users have less registry-level provenance information when deciding whether to run the optional CLI code.
Registry provenance is incomplete even though the documentation references a GitHub repository for optional command-line use.
Source: unknown; Homepage: none
Verify the repository and package contents before executing scanner.js or cloning external code.