long-task-handler-v2

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only helper for managing long-running tasks, though users should notice that it may background powerful commands and use sub-agents for very long work.

This skill appears safe to use as a progress-reporting helper for long tasks. Before relying on it for deploys, migrations, git pushes, or other impactful commands, confirm the action explicitly, monitor progress reports, and ensure you can cancel or clean up background jobs.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A long-running command the user requested may keep running in the background while the user continues other work.

Why it was flagged

The skill is designed to handle long-running command/tool work and may background it automatically based on duration. This fits the purpose, but some listed tasks can mutate repositories, deployments, or local environments.

Skill content
包含已知慢命令:ffmpeg, docker, webpack, tsc, npm build, git push ... 编译/部署/训练/迁移场景 ... shouldBackground: indicators.duration > 1 || indicators.background
Recommendation

Keep explicit confirmation for high-impact operations such as deploys, migrations, terraform/kubectl actions, or git pushes, and make sure there is a clear way to stop the job.

What this means

Very long jobs may continue through a background or sub-agent workflow rather than a single immediate response.

Why it was flagged

The skill can use sub-agents/background sessions for very long tasks. This is disclosed, purpose-aligned, and partially bounded by concurrency and timeout settings.

Skill content
| 超长任务 | >10min | 子代理隔离 | 每2分钟汇报 + 完成通知 | ... maxConcurrentLongTasks: 3
Recommendation

Use it for tasks where background execution is acceptable, and require visible status, completion notice, timeout, and cancellation controls.

What this means

Build, deployment, or data-processing logs could be retained by the task/session archive if they contain sensitive details.

Why it was flagged

The configuration suggests task output or session state may be archived after long-running work. The artifact does not show exfiltration, but archived logs can contain sensitive command output.

Skill content
autoArchive: true
archiveAfterMinutes: 60
Recommendation

Avoid printing secrets in long-task logs and verify where archived task output is stored and how it can be deleted.