Back to skill
Skillv1.0.1
ClawScan security
Focus Tree · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 13, 2026, 4:27 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements align with its stated purpose: a Node-based tool that reads/writes FOCUS.md and FOCUS-LOG.md to maintain a single active work focus.
- Guidance
- This skill appears to do what it says: read and update two files (FOCUS.md and FOCUS-LOG.md) to maintain a single active work focus. Before installing or enabling it: (1) ensure you have Node available if you want to run the bundled script; (2) back up any existing FOCUS.md/FOCUS-LOG.md in your workspace because the tool may overwrite them; (3) do not store secrets or sensitive credentials in FOCUS.md (the skill will read/write that file); and (4) verify the repository/source if provenance matters (the package is MIT-licensed and small, but the homepage is 'unknown' in the metadata). Otherwise there are no signs of hidden network calls, extra credential requests, or escalated privileges.
Review Dimensions
- Purpose & Capability
- okName/description require a local file-based focus tracker; the package.json and scripts/focus.mjs implement exactly that. The declared required binary 'node' is appropriate and nothing else (binaries/env/config) is requested.
- Instruction Scope
- noteSKILL.md instructs the agent to read and update FOCUS.md and FOCUS-LOG.md at session boundaries and on triggers — this matches the script which reads/writes only those files in the current working directory. Note: the skill intentionally performs local filesystem reads/writes (it will create/overwrite FOCUS.md and append to FOCUS-LOG.md), so users should avoid storing secrets in those files and consider backing up any existing FOCUS.md before use.
- Install Mechanism
- okNo install spec; this is instruction-only plus a small Node script included in the bundle. There are no external downloads or package installs described, so nothing is written to disk beyond the script's normal file operations when run.
- Credentials
- okNo environment variables, credentials, or config paths are required. The script does not access unrelated services or secret-bearing env vars, so requested access is proportionate to the functionality.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. The script persists data only to FOCUS.md and FOCUS-LOG.md in the current working directory; it does not modify system-wide settings or other skills' configs.