Ironclaw Pipeline Analytics

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The generated report may reveal CRM or pipeline information in chat, especially if the user asks broad questions or requests detailed breakdowns.

Why it was flagged

The skill directs the agent to generate and run SQL over workspace data. This is central to the dashboard purpose, but it gives the agent access to CRM/business data returned by those queries.

Skill content

→ Translate to DuckDB SQL against workspace pivot views (v_*)
→ Execute query
→ Format results as report-json

Recommendation

Use this only where the agent is allowed to query the workspace DuckDB/CRM data, prefer aggregate read-only analytics, and review results before sharing dashboards externally.