Clawdbot Documentation Expert

PassAudited by ClawScan on May 1, 2026.

Overview

This skill is a coherent Clawdbot documentation helper with simple, disclosed helper scripts and no evidence of hidden data access or destructive behavior.

This skill appears safe for documentation assistance. Before installing, note that its publisher source is not linked, its helper scripts are shell commands, and any real provider tokens used with the example configs should be protected outside the chat and scoped appropriately.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may suggest or run local helper scripts for documentation lookup, but the reviewed scripts do not show hidden or destructive behavior.

Why it was flagged

The skill instructs use of local shell scripts, but this is disclosed, central to the documentation-search purpose, and the provided script contents are simple documentation-related echo commands.

Skill content
./scripts/search.sh discord # Find docs by keyword
./scripts/fetch-doc.sh gateway/configuration # Get specific doc
Recommendation

Use the scripts only from this skill’s directory and review any future script changes before running them.

What this means

Users have less external provenance information to verify who maintains the skill or where updates come from.

Why it was flagged

The package provenance is limited because no source repository or homepage is provided, though the included files are small, dependency-free, and static-scan clean.

Skill content
Source: unknown
Homepage: none
Recommendation

Prefer installing from trusted publishers and re-check the file contents when updating this skill.

What this means

If users adapt these snippets, they may handle real bot or provider tokens outside the skill.

Why it was flagged

The config snippets include expected placeholder tokens for provider setup; the artifacts do not show the skill reading, storing, or transmitting real credentials.

Skill content
"token": "${DISCORD_TOKEN}"
Recommendation

Keep real tokens in environment variables or a secret manager, avoid pasting secrets into chat, and scope provider tokens according to the provider’s guidance.