AI Customer Service KB Builder

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If given the wrong inputs, it could read a sensitive local document, contact an unintended website, or overwrite an output file.

Why it was flagged

The CLI reads a user-specified file, fetches a user-specified URL, and writes to a user-specified output path. This is expected for a KB builder, but users should ensure the paths and URLs are intentional.

Skill content
const content = fs.readFileSync(filePath, 'utf8'); ... client.get(url, (res) => { ... }); ... fs.writeFileSync(outputPath, JSON.stringify(kb, null, 2), 'utf8');
Recommendation

Use explicit trusted file paths and URLs, verify you are allowed to scrape the target site, and choose output paths that will not overwrite important files.

What this means

Incorrect, outdated, or manipulated FAQ content could be stored and later used to answer customers incorrectly.

Why it was flagged

The skill turns document or website content into a persistent knowledge base that may later influence automated customer replies. That is purpose-aligned, but the source content should be reviewed before reuse.

Skill content
Input FAQ documents or website URLs to automatically generate a knowledge base and configure auto-reply capabilities.
Recommendation

Review and edit the generated knowledge base before deploying it in any customer-facing automation, and prefer trusted source documents or websites.