Claw Score

ReviewAudited by ClawScan on May 10, 2026.

Overview

This skill is mostly aligned with its audit purpose, but it sends potentially private agent configuration and memory files to an external service without actually showing the promised preview before upload.

Install only if you are comfortable sharing your agent configuration with Atlas. Before running it, manually inspect and redact AGENTS.md, MEMORY.md, USER.md, SECURITY.md, and related files; do not rely solely on the built-in sanitizer, and be aware that the included script does not show the full payload preview promised in the documentation.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI06: Memory and Context Poisoning

What this means

Private agent instructions, memory details, user context, and security configuration could be disclosed to Atlas if the sanitizer misses sensitive content.

Why it was flagged

The script collects agent instructions, memory configuration, security rules, and user context files. These can contain sensitive agent state or private user information, and the skill is designed to send them outside the workspace.

Skill content

FILES=(
    "AGENTS.md"
    "SOUL.md"
    "MEMORY.md"
    "TOOLS.md"
    "SECURITY.md"
    "HEARTBEAT.md"
    "USER.md"
    "IDENTITY.md"
)

Recommendation

Review the listed files manually before running the submission, remove secrets or private context yourself, and use a temporary audit copy if possible.

Medium

#ASI09: Human-Agent Trust Exploitation

What this means

A user may believe they will get a chance to inspect exactly what is uploaded, but the included script does not provide that review step.

Why it was flagged

This privacy/control claim is not matched by submit.sh, which only prints found file names and the email before asking "Proceed?" and does not display the sanitized file contents or final payload.

Skill content

You'll see a preview of what's being sent before confirmation.

Recommendation

Add an actual preview of the sanitized payload before the confirmation prompt, or clearly state that only file names are shown unless the user manually inspects the files.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Running the script transmits selected local markdown files and a file tree to an external service.

Why it was flagged

The script uses curl to submit the collected workspace payload to the disclosed Atlas endpoint. This is central to the stated audit purpose, but it is still a network upload of local files.

Skill content

RESPONSE=$(curl -s -X POST "$WEBHOOK_URL" \
        -H "Content-Type: application/json" \
        -d "$PAYLOAD")

Recommendation

Run it only after confirming the endpoint and checking the files you are comfortable sharing.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installation or execution may fail or behave differently depending on local tool availability, and users may not realize a local script is part of the workflow.

Why it was flagged

Despite being labeled instruction-only with no declared required binaries, the package includes submit.sh and the workflow depends on local tools such as bash, python3, sed, find, and curl. This appears purpose-aligned but under-declared.

Skill content

Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Declare the required local tools and make clear that the skill includes and runs a submission script.