Back to skill
Skillv1.0.3
ClawScan security
Foam Notes · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 23, 2026, 9:31 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, runtime instructions, and requested access are consistent with a local Foam note management tool — it reads and writes files in your Foam workspace but does not request credentials or make network calls.
- Guidance
- This skill appears to be a straightforward local Foam workspace utility: it scans and edits Markdown files under a specified foam_root, copies local templates into your workspace, and produces reports like backlinks and graph summaries. Before installing or running: 1) Confirm you trust the skill source (publisher is unknown here). 2) Set foam_root (via --foam-root or FOAM_WORKSPACE or config.json) to avoid accidentally pointing the scripts at an unintended directory. 3) Review the templates in assets/templates before running init_templates.py if you don't want them copied into your workspace. 4) Note: init_templates.py can prompt interactively if the target doesn't look like a Foam workspace and suggest confirming before proceeding. There are no network calls or credential requests, but as always, run code from untrusted publishers in an isolated environment if you have any concern.
Review Dimensions
- Purpose & Capability
- okName/description (Foam notes: create, edit, backlinks, templates, tags, suggestions) matches the included scripts and docs. The included Python scripts implement the advertised features (create_note, daily_note, find_backlinks, graph_summary, init_templates, suggest_wikilinks/suggest_tags, etc.). There are no unexpected credentials, cloud SDKs, or unrelated binaries required.
- Instruction Scope
- okSKILL.md and the scripts keep operations within the Foam workspace: scanning and editing Markdown files under foam_root, copying templates to .foam/templates, and printing results. The only interactive behavior is an input() prompt in init_templates.py when the target directory doesn't look like a Foam workspace; otherwise scripts use CLI args or FOAM_WORKSPACE. There are no instructions to read unrelated system state, exfiltrate data, or call external endpoints.
- Install Mechanism
- okNo install spec; this is instruction-only with bundled Python scripts. That lowers supply-chain risk. Scripts are plain Python and do not download or execute remote code. They write files only under the detected foam_root and the skill's own assets/templates directory when copying templates.
- Credentials
- okThe skill does not require any credentials or special environment variables. It optionally respects FOAM_WORKSPACE or a --foam-root argument to locate the workspace; these are appropriate for its purpose. It does not request or access other secrets or unrelated config paths.
- Persistence & Privilege
- okSkill is not always-enabled and does not request system-wide privileges. It reads and writes files in the user's Foam workspace (expected behavior). It does not modify other skills' configs or agent-wide settings.