Starwars

PassAudited by ClawScan on May 1, 2026.

Overview

This is a low-impact Star Wars lookup skill, but its docs reference an executable/script that is not included in the provided package.

This appears safe for simple Star Wars lookups. Before manual installation, verify the external GitHub repository because the executable script is not included in the reviewed package. No API key is required.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If you manually install from the external repository, you may be running code that was not part of the reviewed artifact set.

Why it was flagged

The README points users to install and expose a script from an external GitHub repository, but that script is not included in the provided reviewed package.

Skill content

git clone https://github.com/jeffaf/starwars-skill.git
cd starwars-skill
chmod +x scripts/starwars
# Add to PATH or symlink
ln -s $(pwd)/scripts/starwars /usr/local/bin/starwars

Recommendation

Prefer the packaged ClawHub install when available, or inspect and trust the external repository before cloning, chmodding, or symlinking its script.

Info

#ASI02: Tool Misuse and Exploitation

What this means

The agent may run the Star Wars lookup command when you ask relevant questions, but the documented actions are low-impact information retrieval.

Why it was flagged

The skill instructs the agent to run a local CLI command, which is expected for this lookup tool and appears limited to Star Wars-related queries.

Skill content

When user asks about Star Wars:
1. Run `./starwars people "name"` to find characters
2. Run `./starwars planets "name"` for planet info

Recommendation

Use it for Star Wars lookup requests only, and avoid passing unrelated personal or sensitive text as search terms.