Skill Audit

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to run a local, read-only audit of installed skill folders and write a report, with no credential use, network access, or destructive actions evident.

This looks safe for a user-directed skills audit. Before installing, be comfortable with the agent running the included local shell script, reading installed skill folders, and saving a report that may include local skill names and paths.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may run a local shell script on your machine to inspect installed skill folders.

Why it was flagged

The skill directs the agent to execute an included local shell script. This is expected for the audit purpose, and the script is included in the supplied artifacts.

Skill content
The agent will:
1. Run `scripts/audit.sh` to scan all skill locations and collect metadata
Recommendation

Use it when you intentionally want a skills audit, and review the included script if you are cautious about local command execution.

What this means

The audit can list local skill names, paths, and structural metadata.

Why it was flagged

The script uses shell tools to enumerate workspace and global skill directories. This is scoped to the stated audit purpose and does not show destructive actions.

Skill content
find "$WORKSPACE_SKILLS" -maxdepth 2 -name "SKILL.md" ...
find "$GLOBAL_SKILLS" -maxdepth 2 -name "SKILL.md"
Recommendation

Be aware that the report may reveal your local skill inventory and paths; run it only in environments where that is acceptable.

What this means

A local report file may remain after the audit and could reveal skill names or local paths if shared.

Why it was flagged

The skill creates a persistent audit summary. This is disclosed and purpose-aligned, but the saved report may contain local skill inventory information.

Skill content
Results are written to `.sub-agent-results/skill-audit-report.md` and summarized in chat.
Recommendation

Review or delete the generated report if local path or skill inventory details are sensitive.