Skillv0.2.1

ClawScan security

Trace Debuger · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousMar 5, 2026, 11:43 AM

Verdict: suspicious
Confidence: high
Model: gpt-5-mini
Summary: The skill mostly does what it claims (fetch Jaeger traces and ES logs and analyze them), but there are several inconsistencies and operational details that are not declared and raise risk (undisclosed CLI dependency, a hard-coded example repo path, a strict one-message upload + delete workflow that can hide traces).
Guidance: Before installing or running this skill: (1) Understand it will read any files under the provided repo_path and send logs+code to an external 'codex' tool invoked by subprocess — confirm what 'codex' does and where it sends data. (2) The skill metadata does not declare the 'codex' CLI as a required binary or any auth variables for ES/Jaeger — expect manual setup or failures. (3) Avoid providing paths to sensitive repositories; run first in a sandbox or VM with limited network access. (4) If you need to use it with private Jaeger/ES, verify how credentials are supplied and that you trust the external analysis service. (5) Consider inspecting or running the included script locally to confirm behavior (and remove or change the hard-coded example repo_path) before granting it access to real data.

Review Dimensions

Purpose & Capability: concernThe name/description (trace debugging via Jaeger + Elasticsearch + optional repository context) matches the script's behavior. However, the SKILL.md and script expect an external 'codex' analysis step (runs a codex CLI/subprocess) and access to local repository files, yet the registry metadata declares no required binaries or environment variables. The default repo_path in SKILL.md points to a specific absolute user path (/Users/noodles/...) which is unusual for a generic skill and may be a leftover from development.
Instruction Scope: concernSKILL.md instructs the agent to run the included Python script, fetch traces from jaeger_url and logs from es_url, and optionally scan a local repo. It also mandates that the generated Markdown file be sent to the user as ONE chat message with a strict caption format and then deleted locally. That strict single-message upload + deletion step could be used to obfuscate data transfer and reduces auditability. The instructions instruct running 'codex exec' (or equivalent) against repository and logs, which will send code/log data to an external tool/service.
Install Mechanism: noteThere is no install spec (instruction-only), which minimizes disk writes. However, the runtime flow relies on an external CLI ('codex') invoked via subprocess. The skill metadata does not declare this required binary—this mismatch is a practical omission (the skill will fail or behave differently if codex is not present).
Credentials: concernThe skill declares no required environment variables, but it will access network endpoints (jaeger_url, es_url) and arbitrary local files under the provided repo_path. If the codex CLI sends data to an external service, analysis results and repository contents could leave the host. The default absolute repo_path is a red flag (points to a particular user's Desktop). No authentication handling for ES/Jaeger is declared (these services often require credentials), so users might supply credentials ad hoc or the script might be run against local, unauthenticated endpoints.
Persistence & Privilege: okThe skill does not request permanent presence (always:false) and does not modify other skill configs. It writes a local Markdown file and explicitly instructs deletion afterwards; the deletion behavior itself is not privileged but combined with the one-message upload requirement reduces leftover artifacts for inspection.