Pet-Game workflow

ReviewAudited by ClawScan on May 11, 2026.

Overview

This is a plausible local backup workflow, but it asks the agent to run Python backed by unbundled local code and does not clearly confine backup/restore actions to the intended project files.

Review the local backup_core implementation before enabling this skill, make sure the wrapper is confined to the Pet-Game workspace, and confirm that .backups is excluded from sharing or version control.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Medium

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing this skill could cause the agent to run local code that was not included in the reviewed package whenever it follows the backup workflow.

Why it was flagged

The executable wrapper imports its core behavior from a hard-coded local module outside the supplied manifest, so the reviewed artifacts do not show what backup, restore, or clean actually do.

Skill content

sys.path.insert(0, r'C:\\Users\\marsz\\.qclaw\\workspace\\tools\\backup_system\\core')
from backup_core import SmartBackup

Recommendation

Include and review the backup_core source, pin or declare the dependency and path clearly, and avoid importing executable code from an undeclared absolute user directory.

Medium

#ASI02: Tool Misuse and Exploitation

What this means

A mistaken or crafted path such as one containing '..' or an absolute path could make backup/list/restore operate outside the intended Pet-Game project, depending on platform and SmartBackup behavior.

Why it was flagged

The wrapper accepts a user/agent-supplied path and joins it to the project path without normalization or checks that it remains inside the project; restore can mutate files through the external backup module.

Skill content

rel_path = sys.argv[2]
full_path = os.path.join(PROJECT_PATH, rel_path)
...
result = sb.restore(full_path, idx)

Recommendation

Reject absolute paths and '..' traversal, normalize and verify paths stay under the project root, and require explicit user confirmation for restore and cleanup operations.

Low

#ASI06: Memory and Context Poisoning

What this means

If edited files contain secrets or sensitive project data, old copies may remain in the backup area until cleaned and could be accidentally shared or committed.

Why it was flagged

The workflow intentionally stores persistent backup snapshots and state for edited project files.

Skill content

.backups/                     # 备份区
├── baselines/               # 基准快照
├── elements/              # 频繁元素快照
└── state.json             # 版本状态

Recommendation

Keep .backups out of version control, avoid backing up sensitive secrets, and document retention and cleanup behavior clearly.