Plc

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a simple local note-style CLI rather than a real PLC controller interface; it runs a local script and stores user-added entries under ~/.plc.

This skill looks safe for basic local note-style use, but it is not a PLC programming or safety tool. Before installing, be comfortable with a bash script creating ~/.plc, storing entries there, and exporting files in your working directory; avoid saving secrets or sensitive control-system information.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI05: Unexpected Code Execution

What this means

The skill can run local shell commands that create, read, update, and export its own data files.

Why it was flagged

Using the skill involves running the included bash script. This local command execution is clearly documented and central to the skill's CLI behavior.

Skill content

```bash
scripts/script.sh status
```

Recommendation

Run it only as your normal user, avoid elevated privileges, and review the script before use if you are concerned about local file changes.

Low

#ASI06: Memory and Context Poisoning

What this means

Any sensitive PLC notes, configuration details, or instruction-like text added to the tool will remain on disk and may be shown back to the agent later.

Why it was flagged

The script persists arbitrary user-provided entries in a local JSONL file, which can later be listed, searched, or exported.

Skill content

DATA_DIR="${PLC_DIR:-$HOME/.plc}"
...
printf '{"ts":"%s","cmd":"%s","val":"%s"}\\n' "$ts" "$cmd" "$val" >> "$DATA_DIR/data.jsonl"

Recommendation

Do not store secrets or sensitive industrial control details unless local persistence is intended; treat listed or exported entries as user data, not trusted instructions.

Info

#ASI09: Human-Agent Trust Exploitation

What this means

Users should not assume this skill validates PLC programs, connects to controllers, or provides industrial safety checks.

Why it was flagged

The advertised PLC-helper purpose is more specific than the implemented generic entry-management commands.

Skill content

description: "Programmable logic controller programming helper"
...
Commands:
  status
  add
  list
  search
  remove
  export
  stats
  config

Recommendation

Treat it as a simple local entry/log manager unless additional PLC-specific functionality is provided and reviewed.