Pokemon

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a simple Pokémon lookup skill, with the main caution that its README points users to install missing CLI scripts from an unpinned GitHub repository.

This skill is low risk for normal Pokémon lookups and does not require an account or API key. The only meaningful caution is installation provenance: the package does not include the actual CLI scripts, so review or pin the GitHub source before making those scripts executable.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user follows the README installation steps, they may run code from a repository that was not included in this reviewed artifact set.

Why it was flagged

The README directs installation of executable scripts from an unpinned external GitHub repository, while the submitted package itself contains only README.md and SKILL.md.

Skill content

git clone https://github.com/jeffaf/pokemon-skill.git ~/clawd/skills/pokemon

# Make executable
chmod +x ~/clawd/skills/pokemon/pokemon
chmod +x ~/clawd/skills/pokemon/scripts/pokemon

Recommendation

Before installing from GitHub, review the repository contents or pin to a trusted commit; ideally the skill package should include the actual CLI files or a declared install spec.