Blogwatcher Moss

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a straightforward wrapper for a blog/RSS monitoring CLI, with the main thing to notice being that it installs an external Go package at the latest version.

This appears safe to use as a simple RSS/blog monitoring helper. Before installing, make sure you trust the upstream GitHub project because the install command pulls the latest version of its Go CLI.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill depends on trusting the upstream blogwatcher project and whatever version is current at install time.

Why it was flagged

The skill installs an external Go module using `@latest`, so the installed code can change as the upstream project changes. This is expected for a CLI wrapper, but users should be aware of the dependency provenance.

Skill content

Go: `go install github.com/Hyaxia/blogwatcher/cmd/blogwatcher@latest`

Recommendation

Install only if you trust the upstream repository; prefer a pinned version if reproducibility is important.