Tire

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A user or agent may be unsure where the `tire` command comes from.

Why it was flagged

The skill is documented as a command-line tool, but the registry does not declare how the `tire` command is provided or installed, so users should confirm they are invoking the intended packaged script rather than an unrelated local command.

Skill content
Required binaries: none ... Install specifications: No install spec — this is an instruction-only skill.
Recommendation

Verify the installation path/source before running `tire`, and prefer a package update that declares the required binary or installation mechanism.

What this means

Anything typed into the tool may be saved locally and visible in future history, search, or export output.

Why it was flagged

The script persistently stores user-provided command input in local log files. This is disclosed and purpose-aligned, but entries can remain on disk and be searched or exported later.

Skill content
DATA_DIR="${HOME}/.local/share/tire" ... echo "$ts|$input" >> "$DATA_DIR/run.log"
Recommendation

Avoid entering passwords, tokens, or private information, and clear `~/.local/share/tire` if you do not want old entries retained.