Env Setup
Analysis
This instruction-only skill is purpose-aligned, but it will inspect local environment files and may suggest project file or git-history changes that users should review.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
grep -rn "process\.env\.\w\+" ... . | grep -v node_modules | grep -v dist
The skill instructs recursive local searches through the codebase, which is expected for environment-variable discovery but should remain limited to the intended project.
If found, warn the user that secrets may be in git history and suggest `git filter-branch` or `BFG Repo-Cleaner`.
Rewriting git history can affect collaborators and shared repositories; the artifact only suggests these tools as remediation, which is appropriate but worth user review.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
If `.env` exists, compare against discovered variables
.env files often contain API keys, tokens, passwords, and other secrets; the skill's examples report variable names rather than values, making this purpose-aligned but sensitive.