Preflight Checks

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent behavior-testing skill, but it creates persistent workspace instructions and includes user-specific examples that should be reviewed before use.

This skill appears safe for its stated purpose. Before installing, verify any manual GitHub source, run scripts only in the intended workspace, review generated PRE-FLIGHT files, do not copy the Prometheus examples as-is, and set clear approval rules for messaging, public posting, and persistent memory updates.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Future sessions may follow whatever is written in these files; incorrect, stale, or sensitive entries can shape the agent's behavior.

Why it was flagged

The framework intentionally makes local memory and answer files recurring context for behavior verification.

Skill content
After loading identity and memory (SOUL.md, USER.md, MEMORY.md, daily notes): ... Read this file completely ... Compare your answers with `PRE-FLIGHT-ANSWERS.md`
Recommendation

Keep the pre-flight files in a trusted workspace, review them before adding every-session integration, and avoid storing secrets or unnecessary personal data in them.

What this means

If a user adopts these example answers without customization, their agent may treat some messaging actions as pre-approved.

Why it was flagged

An included example policy allows private Telegram messages without confirmation. It is example content, not executable code, but copying it as-is could authorize outbound messaging behavior.

Skill content
**NO, don't ask permission** ... Safe to do freely: send messages, test features
Recommendation

Customize communication checks for your own risk tolerance, and require explicit approval for public channels, third parties, or any private-channel actions you do not want automated.

What this means

Running the setup script will create or potentially overwrite local pre-flight Markdown files in the current or configured workspace.

Why it was flagged

The initialization script is user-run shell code that writes template files into the selected workspace and prompts before overwriting an existing checks file.

Skill content
cp "$SKILL_DIR/templates/CHECKS-template.md" "$WORKSPACE_DIR/PRE-FLIGHT-CHECKS.md"
Recommendation

Run the script only from the intended workspace, review overwrite prompts, and inspect generated files before relying on them.

What this means

A manual install from the remote repository could differ from the reviewed package contents if the repository changes.

Why it was flagged

The documented manual install path retrieves a remote repository without a pinned commit. The registry metadata also lists the source as unknown and homepage as none.

Skill content
git clone https://github.com/IvanMMM/preflight-checks.git
Recommendation

Prefer the reviewed registry package or verify the repository, commit, and file contents before running its scripts.