Parser

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a straightforward local parsing utility, with the main considerations being local script execution and possible local caching of parsed results.

This skill looks appropriate for local file parsing. Before installing or using it, be aware that it runs a bundled shell script, some commands need python3 or optionally jq, and parsed results may be cached locally.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Some commands may fail unless python3 is available, and jq changes the JSON parsing path when installed.

Why it was flagged

The skill text discloses runtime dependencies, while the registry metadata lists no required binaries. This is purpose-aligned but may cause setup surprises.

Skill content
## Requirements

- python3
- jq (optional)
Recommendation

Confirm python3 is installed before using XML/YAML parsing, and treat jq as an optional dependency for JSON parsing.

What this means

Using the skill runs local helper code on files you provide.

Why it was flagged

The skill is designed to invoke a bundled local shell script. This is expected for a command-line parser, but it is still local code execution.

Skill content
```bash
scripts/script.sh json
```
Recommendation

Use it only on files you intend to parse, and review the bundled script if your files contain sensitive information.

What this means

Parsed content from private files could remain on disk in a local cache.

Why it was flagged

The skill discloses local caching of parse results, which may retain structured data extracted from user files.

Skill content
## Data Storage

Parse results can be cached in `~/.local/share/parser/`.
Recommendation

Avoid parsing secrets unless you are comfortable with local caching, or clear the parser cache after use.