Back to skill
Skillv1.0.0
ClawScan security
trouble-shooting · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 24, 2026, 7:47 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- This skill's behavior (creating git worktrees or subagents, saving snapshots, applying or discarding changes) is consistent with its stated purpose, but it assumes git and will modify the repository working tree/branches and write local files — review and back up your repo before use.
- Guidance
- Before installing or running this skill: 1) Be aware it expects git to be available (scripts call git commands) though git is not declared; install git if needed. 2) The scripts will create a .trouble-shooting directory, temporary worktree folders, and temporary git branches (named trouble/<id>), and may merge changes into your current branch or delete branches — back up or commit/uncommitted-work stash before using. 3) Review the three included Python scripts (start/finish/list) — they run local subprocesses and modify the repo; ensure you trust them in your environment. 4) During 'apply' the tool attempts an automatic merge (git merge --no-edit) and will fail if conflicts exist; be prepared to resolve conflicts manually. 5) If you need stricter safety, run start_troubleshoot.py in 'subagent' mode (no worktree) or run the scripts in a disposable clone first. If you want higher assurance, ask the author to declare git as a required binary and to add explicit confirmation prompts before destructive operations.
Review Dimensions
- Purpose & Capability
- noteThe skill's name/description match what the included scripts do: create isolated troubleshooting environments, save snapshots, apply/discard changes, and archive results. However, the package metadata declares no required binaries while the scripts call git heavily (git worktree, git merge, git branch, git checkout). Git is a legitimate dependency for this purpose but is not declared.
- Instruction Scope
- noteSKILL.md stays on-topic describing worktree vs subagent flows. The runtime scripts operate on the local repository and filesystem: writing .trouble-shooting/active.json and archive files, creating/removing worktrees, merging branches, and deleting temporary branches. There are no network endpoints or secret exfiltration steps. The instructions give the agent discretion to create and apply changes in the repo, so user consent/confirmation before applying merges is important.
- Install Mechanism
- okThis is instruction-only with bundled scripts and no install spec; nothing is downloaded or executed from remote URLs. That is a low-risk install profile.
- Credentials
- okThe skill requests no environment variables or external credentials and the scripts do not attempt to read secrets or external configs. The local file writes are limited to a .trouble-shooting directory and git operations on the repository.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide persistent privileges. It creates local state (.trouble-shooting) inside the working directory and manipulates git branches, which is appropriate for a troubleshooting helper but does modify repository state.