Warehouse

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

You may need to manually connect the documented command to the included script, which can cause confusion if a different `warehouse` binary is already present or installed from elsewhere.

Why it was flagged

The artifacts also include a shell script and SKILL.md assumes a `warehouse` CLI command, so users should verify what command or script is actually being installed/invoked.

Skill content
No install spec — this is an instruction-only skill.
Recommendation

Verify the installed `warehouse` command points to the reviewed script/source before using it.

What this means

Anything entered into the tool may remain on disk and may later appear in status, history, search, or export outputs.

Why it was flagged

User-supplied command input is saved persistently in local log files under the warehouse data directory.

Skill content
DATA_DIR="${HOME}/.local/share/warehouse"
...
echo "$ts|$input" >> "$DATA_DIR/ingest.log"
Recommendation

Avoid entering secrets or sensitive data unless you intend to store them locally; periodically review or delete `~/.local/share/warehouse/` if needed.