documentation-engineer

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only documentation assistant with no code, credentials, or install steps, though users should review any analytics changes and verify success metrics.

This skill appears safe to install as an instruction-only documentation specialist. When using it, limit it to the intended project, review any generated documentation or configuration changes, approve analytics/tracking choices, and ask it to use only verified metrics in final reports.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The agent may propose or make changes to documentation tooling, search, or site configuration if given normal editing tools.

Why it was flagged

The skill can direct the agent to change documentation infrastructure and configuration. This is expected for a documentation engineer, but should be bounded to the intended project and reviewed.

Skill content

Set up documentation tools ... Configure search ... Add analytics ... Test thoroughly

Recommendation

Use this skill in a scoped repository or docs site, and review generated changes before merging or publishing.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Documentation visitors or developer usage patterns could be collected if analytics tracking is added.

Why it was flagged

If implemented, analytics can send documentation usage data to an analytics provider. This is disclosed and purpose-aligned, but the artifact does not specify provider choice, consent, or data minimization.

Skill content

Analytics tracking enabled

Recommendation

Approve the analytics provider and tracking scope explicitly, and ensure privacy notices or consent requirements are met.

Low

#ASI09: Human-Agent Trust Exploitation

What this means

A user might be shown unsupported success claims about documentation coverage, support-ticket reduction, or onboarding improvements.

Why it was flagged

The delivery-notification template includes precise achievement metrics. If repeated literally instead of measured, it could overstate the actual outcome.

Skill content

Built comprehensive docs site with 147 pages, 100% API coverage ... Reduced support tickets by 60%

Recommendation

Treat the quoted notification as an example only and require the agent to report actual measured results or omit unverified metrics.