Files

ReviewAudited by ClawScan on May 1, 2026.

Overview

This file-management skill is purpose-aligned and includes safeguards, but it can move, rename, trash, and analyze local files, so users should review its scope before use.

This appears safe to install for local file organization if you are comfortable letting the agent modify files in selected folders. Review previews carefully, avoid broad targets like your entire home directory unless necessary, confirm bulk operations deliberately, and clear the undo/hash cache if its metadata is sensitive.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

If used carelessly, the agent could move, rename, or trash files in ways that disrupt the user's organization, though the skill requires safeguards for bulk and destructive operations.

Why it was flagged

The skill explicitly authorizes bulk local file operations that can change or remove user files. This is central to the stated purpose and is paired with confirmations, manifests, trash handling, and undo support.

Skill content

**YES:** Organize existing files, find duplicates, analyze disk usage, batch rename/move, clean up clutter

Recommendation

Use the skill on clearly scoped folders, review previews and manifests, and require explicit confirmation before large or irreversible changes.

Low

#ASI06: Memory and Context Poisoning

What this means

Local records could expose information about files that were moved, deleted, or scanned if another process or user can read the cache directory.

Why it was flagged

The skill stores persistent local metadata about file operations and duplicate-detection hashes. This is useful for undo and performance, but it may reveal file paths, organization patterns, and checksum metadata over time.

Skill content

Every operation creates an undo record in `~/.local/share/file-organizer/undo/TIMESTAMP.json` ... Cache hashes in `~/.local/share/file-organizer/hash-cache.db`

Recommendation

Keep the local cache and undo directories protected, and periodically clear them if file names, paths, or hashes are sensitive.