Baseline Kit

PassAudited by ClawScan on May 1, 2026.

Overview

Baseline Kit appears to be a coherent offline OpenClaw config generator and auditor; the main thing to watch is that it can read and write local config files you point it at.

This skill looks safe to install for offline OpenClaw configuration review. Run it only against configs you intend to audit, keep audit outputs private if they reveal where secrets are stored, and review any generated baseline before replacing a real configuration.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill can create or overwrite the output file you specify and can read the config file you ask it to audit.

Why it was flagged

The tool performs local file writes for generated baselines and local file reads for audits using paths supplied to the CLI. This is central to the stated purpose, but users should choose paths carefully.

Skill content

fs.writeFileSync(resolved, `${JSON.stringify(data, null, 2)}\n`, 'utf8'); ... const parsed = JSON.parse(fs.readFileSync(resolved, 'utf8'));

Recommendation

Use explicit, intended paths; avoid pointing --out at an existing production config unless you mean to replace it, and review generated files before rollout.