clawgo-clone

This skill does what it says, but take precautions before running it: only use it if you trust clawgo.me and the key's source. Before copying files into your workspace, inspect the zip listing for any path components (../) or absolute paths and for symlinks. Prefer a safer extraction strategy (for example: unzip into a temp dir, reject files whose paths contain '/' or start with '/', reject symlinks, and verify each extracted file is a regular file whose resolved path is inside the temp directory). Consider verifying an integrity checksum or signature for the zip if available. Keep the created backup directory so you can roll back. If you want, modify the script to explicitly reject symlinks (e.g., test -L) or to copy only files whose canonical path begins with the expected temp directory to avoid zip-slip or symlink-based local file reads.