NextFromKnowledge
Security checks across malware telemetry and agentic risk
Overview
The skill's code, runtime instructions, and requirements align with its stated purpose of turning knowledge into concrete next actions; there are no unexpected credentials, network calls, or install-time downloads.
This skill appears coherent and implements what it claims: a local Node.js text distillation engine and CLI for turning notes into next steps. Before installing or running: (1) review the included files (src/index.js, bin/cli.js, scripts/publish.sh) if you plan to run it on sensitive data — the CLI reads files you point it at and prints output to stdout; (2) avoid piping highly sensitive secrets into the tool unless you trust the runtime environment; (3) the publish script calls a 'clawhub publish' command — only run it if you intend to publish the package; and (4) verify the repository URL in package.json if you want to inspect upstream source history. Otherwise the skill is internally consistent and does not request unexpected permissions or credentials.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings