Skillv1.0.0

ClawScan security

Fuzzy Agent Daily Driver · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 11, 2026, 12:19 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only pattern/reference that is internally consistent with its stated purpose (daily agent workflows); it does not request installs or credentials, but it does instruct the agent to read/write local files, spawn subagents, run processes, fetch web content, and post messages — so users should review platform permissions and sensitive files before enabling it.
Guidance: This skill is a patterns/reference document (no installers or secret requests) and appears coherent with its description. Before enabling it: 1) Verify what your platform's tools (exec/process, sessions_spawn, cron, message, web_fetch) actually permit — especially whether agents can run shell commands or send external messages. 2) Ensure files the skill directs the agent to load (MEMORY.md, TOOLS.md, HEARTBEAT.md, daily notes) do not contain passwords, API keys, or other secrets. 3) If you do not want agents to run arbitrary processes or post to channels, restrict or audit those tool permissions on the platform first. 4) Monitor cron jobs and spawned subagents initially to confirm behavior matches expectations. If you want, provide the agent a sanitized workspace (no sensitive data) or disable exec/process capabilities before using the skill.

Review Dimensions

Purpose & Capability: okThe name/description (daily-driver agent patterns) match the content: the SKILL.md documents memory recall, spawning subagents, scheduling, research, delegation, and monitoring. All referenced tools (memory_search, sessions_spawn, cron, web_fetch, message, exec, process, write, etc.) are coherent with a pattern/reference skill for agent workflows.
Instruction Scope: noteInstructions explicitly tell the agent to read and write workspace files (MEMORY.md, HEARTBEAT.md, DAILY_SKILLS.md, memory/YYYY-MM-DD.md, TOOLS.md), spawn subagents, run background processes (exec/process), perform web_search/web_fetch, and send messages to channels (discord). Those actions are expected for an agent-pattern guide, but they grant broad operational capabilities at runtime; users should ensure the referenced files do not contain secrets and confirm they are comfortable with the agent having process/exec and messaging permissions.
Install Mechanism: okNo install spec and no code files (instruction-only). Nothing is downloaded or written by an installer, minimizing filesystem/remote-code risk.
Credentials: okThe skill requests no environment variables, credentials, or config paths. All declared requirements are proportional to a documentation/pattern skill.
Persistence & Privilege: okalways:false (no forced presence). The skill assumes normal agent tooling (scheduling, spawning, messaging) but does not attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by default on the platform but is not an unusual privilege here.