file-repair-skill

PassAudited by ClawScan on May 10, 2026.

Overview

The skill’s behavior matches its file-repair purpose, but it works by running a bundled Node script that uploads the selected file to a third-party service, so users should avoid sensitive files and verify any download links.

Before installing or using this skill, confirm you are comfortable uploading the selected file to Tenorshare’s online repair service, avoid confidential or regulated documents, and verify the shortened promotional link before downloading any additional client software.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Files you choose for repair leave your local environment and are processed by a third-party service.

Why it was flagged

The skill intentionally sends the selected file to an external provider; this is disclosed and purpose-aligned, but the file may contain private or sensitive data.

Skill content
This skill repairs files by uploading the user-provided file to a third-party online file repair service (Tenorshare 4DDiG Online Repair) and retrieving the repaired result.
Recommendation

Only use this skill for files you are comfortable uploading, and follow the skill’s consent warning for confidential, regulated, or highly sensitive content.

What this means

Installing and invoking the skill allows its bundled script to run locally for the chosen file.

Why it was flagged

Running a local Node.js bundle is central to the skill’s operation and is disclosed, but users should understand that local code will read the selected file and perform network operations.

Skill content
This skill executes a bundled Node.js script: `{baseDir}/dist/repair-file.bundle.cjs`.
Recommendation

Run it only on intended file paths and only if you trust the skill publisher and the bundled script.

What this means

It may be harder for a user to independently verify where the bundled code came from or how it was built.

Why it was flagged

The skill includes a sizable bundled executable script, but the registry metadata does not provide a source repository or homepage for provenance review.

Skill content
Source: unknown; Homepage: none; Code file presence: dist/repair-file.bundle.cjs (357111 bytes)
Recommendation

Prefer skills with clear source provenance when handling important files, or inspect the bundle before use.

What this means

A user could be encouraged to visit an opaque link and download additional software outside the skill.

Why it was flagged

The skill includes an upsell to a shortened external link; it is disclosed and not automatically executed, but the shortened destination is not transparent.

Skill content
Download the client for better service - Visit https://bit.ly/4roS6Rv
Recommendation

Verify the destination and vendor authenticity before opening the shortened link or installing any promoted client.