Evidence URL Verifier

• Risk level: Low
• Analyzed: May 1, 2026, 6:14 AM
• Findings: 1
• Version: 1.0.0

Overview

This instruction-only skill is purpose-aligned for checking evidence links, with the main caution that it may make outbound web requests to supplied URLs and lightly inspect named local artifact paths.

This skill appears safe for its stated purpose. Before using it, be comfortable with the agent making web requests to the evidence links you provide and checking only the local artifact paths relevant to the task.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Low

What this means

The agent may contact third-party sites to verify links and may reveal whether a named local artifact exists and its size.

Why it was flagged

The workflow asks the agent to make outbound HTTP requests to supplied URLs and check local artifact paths. This is expected for verifying evidence, but it is still flexible tool use that should remain limited to task-relevant URLs and paths.

Skill content

Invoke-WebRequest -Uri $url -Method Head -TimeoutSec 10 ... $response = Invoke-WebRequest -Uri $url ... if (Test-Path $artifactPath) { $size = (Get-Item $artifactPath).Length }

Recommendation

Use this only on evidence URLs and local paths you intend to verify; avoid sensitive tokenized, private, or internal links unless the verification is necessary.