Ironclaw Pipeline Analytics

• Risk level: Low
• Analyzed: May 1, 2026, 5:47 AM
• Findings: 1
• Version: 1.0.0

Overview

This is a coherent instruction-only analytics skill, with the main notable risk being expected access to workspace CRM/DuckDB data to create dashboards.

This skill appears safe for its stated purpose as long as you are comfortable letting the agent query your workspace CRM/DuckDB data. Keep requests scoped, avoid asking for unnecessary personal or confidential lead details, and review dashboards before sharing them.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Low

What this means

The generated report may reveal CRM or pipeline information in chat, especially if the user asks broad questions or requests detailed breakdowns.

Why it was flagged

The skill directs the agent to generate and run SQL over workspace data. This is central to the dashboard purpose, but it gives the agent access to CRM/business data returned by those queries.

Skill content

→ Translate to DuckDB SQL against workspace pivot views (v_*)
→ Execute query
→ Format results as report-json

Recommendation

Use this only where the agent is allowed to query the workspace DuckDB/CRM data, prefer aggregate read-only analytics, and review results before sharing dashboards externally.