Weights & Biases Monitor

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a read-only Weights & Biases monitoring helper, with expected W&B credential use and a few scoping/metadata details users should notice.

This skill looks suitable for read-only W&B monitoring, but install it only if you are comfortable letting the agent use your W&B-authenticated environment to display run metrics, configs, summaries, and histories. Specify the entity/project/run explicitly, and avoid using the no-argument watch mode unless the hardcoded defaults are appropriate.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent can view W&B runs, metrics, configs, and summaries available to the logged-in W&B account.

Why it was flagged

The skill explicitly relies on W&B account authentication, which is expected for private run monitoring but gives the scripts access to data available to that W&B identity.

Skill content
wandb login
# Or set WANDB_API_KEY in environment
Recommendation

Use a W&B account/API key with only the access needed for the projects you want monitored, and avoid storing secrets in W&B run configs.

What this means

If used broadly, the skill may surface more W&B project/run information than the user intended to review in the agent session.

Why it was flagged

The skill documents an option that can enumerate all projects for a W&B entity; this is purpose-aligned monitoring behavior but broader than checking a single run or project.

Skill content
`--all-projects` — Check all projects
Recommendation

Prefer explicit entity/project/run arguments unless you intentionally want an all-projects briefing.

What this means

Running the watch script without an entity could check an unintended W&B entity/project set rather than the user's own workspace.

Why it was flagged

The script text says the no-argument mode uses a default entity from config, but the implementation hardcodes a specific entity name.

Skill content
watch_runs.py  # uses default entity from config
...
parser.add_argument("entity", nargs="?", default="chrisvoncsefalvay", help="W&B entity (username/org)")
Recommendation

Always pass the intended W&B entity and projects explicitly, or edit/remove the hardcoded defaults before use.

What this means

Users may need to verify the package environment and publisher trust themselves before relying on the helper scripts.

Why it was flagged

The registry metadata provides limited provenance and no install/dependency declaration even though the included scripts depend on the wandb Python package and W&B authentication.

Skill content
Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill.
Recommendation

Install/verify the wandb package from a trusted source and review the included scripts before using W&B credentials.