Back to skill
Skillv1.0.3
ClawScan security
Workspace Casual Lucas · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousFeb 12, 2026, 1:32 AM
- Verdict
- suspicious
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's claimed purpose (workspace helper) matches its code, but it exposes high-risk capabilities (arbitrary shell execution and unrestricted file reads) and has trigger metadata that could allow remote invocation — proceed only with strong safeguards.
- Guidance
- This skill legitimately implements a workspace helper, but it exposes two powerful actions: running arbitrary shell commands and reading arbitrary files. Before installing, consider: 1) Do you trust the author and host environment? 2) Restrict or remove run_command if you don't need arbitrary shell execution — replace it with a limited set of safe operations. 3) Add input validation and path sandboxing (limit to a single workspace directory). 4) Disable autonomous invocation (set disable-model-invocation = true) or require explicit user confirmation before running commands. 5) Review and, if needed, remove triggers that expose these actions to external channels (triggers.json lists "whatsapp"). 6) Run the skill in an isolated/sandboxed account or container if you must use it. If you cannot apply these mitigations, avoid installing this skill on agents with network access or elevated privileges.
Review Dimensions
- Purpose & Capability
- okThe name/description and code align: the skill lists files, opens files, and runs commands. The use of fs and child_process.execSync is consistent with the declared commands.
- Instruction Scope
- concernAlthough SKILL.md describes workspace operations, the implementation accepts arbitrary paths and arbitrary shell commands (execSync(command)) and resolves arbitrary file paths. This goes beyond a constrained 'workspace-only' scope and allows reading or executing any file/command the agent process can access.
- Install Mechanism
- okNo install spec is present (instruction-only + small index.js). Nothing is downloaded or written during install, reducing supply-chain risk.
- Credentials
- okNo environment variables, credentials, or external config paths are requested; the skill does not ask for unrelated secrets.
- Persistence & Privilege
- concernalways is false, but disable-model-invocation is false (default) so the agent may invoke this skill autonomously. Combined with the ability to execute arbitrary shell commands and read arbitrary files, autonomous invocation increases blast radius. Additionally, triggers.json maps patterns to these commands and lists a channel (whatsapp), which could enable remote-triggered actions if channel integration permits.