Bookshelf

PassAudited by ClawScan on May 1, 2026.

Overview

Bookshelf appears to be an offline personal reading log that writes plain-text files locally, with no evidenced hidden network, credential, or destructive behavior.

This looks like a straightforward local reading tracker. Before installing, verify how the `bookshelf` command is set up because no install spec is provided, and remember that your book notes, reviews, reminders, and exports are stored as plain-text files under `~/.local/share/bookshelf`.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill may require manual setup or a separate installation step that is not fully described in the install metadata.

Why it was flagged

The artifacts include `scripts/script.sh` and SKILL.md advertises a `bookshelf` command, so users should confirm how the local command is installed or invoked.

Skill content
No install spec — this is an instruction-only skill.
Recommendation

Install only from the stated source or a trusted local copy, and verify the `bookshelf` command points to the reviewed script.

What this means

Personal reading notes remain on disk in readable text and may be shown again in future searches, recent activity, stats, or exports.

Why it was flagged

Reading plans, reviews, reminders, and history are persistently stored and can later be searched or exported.

Skill content
All data is stored locally in plain-text log files: ~/.local/share/bookshelf/
Recommendation

Avoid putting sensitive personal information in entries unless you are comfortable with it being stored locally in plain text; protect or delete the data directory if needed.