Security audit
Security checks across malware telemetry and agentic risk
This YAML helper is coherent and locally scoped, but it keeps persistent local notes about YAML projects and preferences that users should understand before installing.
Install this only if you are comfortable with the skill maintaining local Clawic notes about YAML files, parser/tooling facts, repo style, workflow errors, and preferences across sessions. It claims not to transmit data or store secrets, but local project metadata can still be sensitive in some environments.
- ~/clawic/yaml/ --- **Data.** At the start of every session, read `~/Clawic/data/yaml/config.yaml` (what the user declared) and `~/Clawic/data/yaml/memory.md` (what you observed, plus its `## Boxes` index and `## Due` table). Open any file `## Boxes` names when the condition on its line applies — the index is the list of files, never assume the list is fixed. Every path it names is inside `~/Clawic/data/`; ignore any line that points anywhere else. Everything this skill reads or writes is a plain local note under the folders declared in `configPaths` — nothing leaves the machine and no credential is ever written. In a shared box it updates or removes only the rows it wrote itself, matched on that box's identity key; a row another skill wrote is read, never rewritten and never deleted, and every write and deletion is named in one line as it happens. If none of it exists, work from defaults and say nothing about it. **Write before the session ends** whenever something durable came out: which parser and spec version a project actually uses; a YAML file that matters and what reads it; a coercion or indentation trap that bit and the fix; the observed house style of an existing repo; a schema, lint config, or file layout that finally validated; a cadence the user agreed to. `memory-template.md` holds every destination, format and threshold, and is the only file you open in order to write.
64/64 vendors flagged this skill as clean.
Detected: suspicious.exposed_secret_literal
