Pc Health Check

AdvisoryAudited by Static analysis on May 10, 2026.

Overview

Detected: suspicious.dangerous_exec

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI05: Unexpected Code Execution

What this means

Running the skill lets it execute diagnostic PowerShell queries on the local PC.

Why it was flagged

The script executes local PowerShell commands. That is powerful local command execution, but it is disclosed and purpose-aligned with collecting Windows health information.

Skill content

const { execSync } = require('child_process'); ... execSync(`powershell -NoProfile -Command "[Console]::OutputEncoding = [Text.Encoding]::UTF8; ${cmd.replace(/"/g, '\\"')}"`, {

Recommendation

Install only if you trust the skill, and run it only for intended health-check tasks. Prefer quick mode if you only need basic diagnostics.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Generated reports may reveal installed software, startup commands, system errors, listening ports, and other local configuration details.

Why it was flagged

The full scan gathers local event messages, startup commands, process data, and port/process information that may include private system details and then formats them for AI analysis/reporting.

Skill content

Get-WinEvent ... Select-Object TimeCreated, Id, LevelDisplayName, Message ... Get-CimInstance Win32_StartupCommand | Select-Object Name, Command, Location

Recommendation

Keep generated reports private, avoid sharing them publicly without review, and use quick mode if detailed process/startup/event information is unnecessary.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the report could be written somewhere unintended or overwrite an existing file depending on the script's save behavior.

Why it was flagged

The skill supports saving reports to a user-specified path and suppressing terminal output. This is disclosed and useful, but report writes should remain user-directed.

Skill content

--save <path>   保存报告到指定路径
  --silent    静默模式，仅保存文件，不输出到终端

Recommendation

Specify safe report paths explicitly and avoid using --silent unless you intentionally want file-only output.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less upstream context for verifying who maintains the skill or where the source originated.

Why it was flagged

The package has no external dependency installer, which limits supply-chain exposure, but provenance and installation metadata are minimal.

Skill content

Source: unknown
Homepage: none
Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review the included script before installation and prefer installing from a trusted registry/source.

Findings (1)

critical

suspicious.dangerous_exec

Location: scripts/health_check.cjs:23
Finding: Shell command execution detected (child_process).