Doc Generator

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its document-generation purpose, but it tells the agent to install an additional unreviewed workflow skill with automatic confirmation if it is missing.

Before installing, confirm you are comfortable using AnyGen's external service and API key. If the skill asks to install `anygen-workflow-generate`, review and approve that additional skill explicitly rather than allowing automatic `-y` installation.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The agent could add or change installed skill behavior using an unreviewed dependency before generating a document.

Why it was flagged

The skill instructs installation of an additional workflow skill not included in the reviewed artifacts, with `-y` suppressing confirmation and no pinned source/version shown.

Skill content

If the `anygen-workflow-generate` skill is not available, install it first:

```bash
anygen skill install --platform <openclaw|claude-code> -y
```

Recommendation

Require explicit user confirmation before installing additional skills, identify the exact skill/source/version, and avoid no-confirm installation flags unless the user has approved them.

Low

#ASI03: Identity and Privilege Abuse

What this means

The skill needs access to the user's AnyGen account/API quota to generate documents.

Why it was flagged

The skill requires an AnyGen API key for authenticated use of the provider, which is expected for this integration.

Skill content

requires:
  bins:
    - anygen
  env:
    - ANYGEN_API_KEY

Recommendation

Use a dedicated, limited-scope API key if available, and revoke it if you stop using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Prompts, drafts, or source material used for document generation may be processed by AnyGen's servers.

Why it was flagged

The artifact discloses that document generation happens on an external provider service, so user content may leave the local environment.

Skill content

This skill uses the AnyGen CLI to generate structured documents and reports server-side at `www.anygen.io`.

Recommendation

Avoid sending confidential material unless you trust AnyGen's data handling terms and have permission to use the service for that content.