Go Jek

AdvisoryAudited by Static analysis on May 5, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteMedium Confidence

ASI03: Identity and Privilege Abuse

What this means

If the platform treats these capability labels as real permissions, the skill could appear to need more sensitive authority than its informational purpose requires.

Why it was flagged

These signals describe high-impact wallet, purchase, and credential-related capabilities, but the actual SKILL.md content is informational and the requirements declare no credentials. This appears unsupported by the visible skill behavior, but users should still notice the mismatch.

Skill content

- crypto
- requires-wallet
- can-make-purchases
- requires-sensitive-credentials

Recommendation

Install or use it only as a read-only informational skill; do not provide wallet, payment, or sensitive credentials unless a future version clearly justifies and scopes that access.