Intent Align
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only skill is coherent and purpose-aligned, but users should deliberately scope any repo, GitHub, tracker, and persistent hub access they allow.
This skill appears safe to install as an instruction-only alignment workflow. Before using it, choose a conservative autonomy mode for important work, grant only the repository or service permissions needed for the current task, and review the generated alignment hub so it does not store secrets or stale instructions.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If a higher-autonomy mode is selected, the agent may keep working through low-risk phases with only summaries or log-only check-ins.
The skill explicitly defines modes where the agent may continue across phases without confirmation at every step. This is disclosed and bounded by drift/risk checks, but it affects how much direct oversight the user has.
`3 Aggressive`: Auto-continue on low drift; require confirmation on major deltas. `4 Exploratory`: Continue with log-only check-ins unless risk or ambiguity threshold is exceeded.
Use Strict or Balanced mode for sensitive, irreversible, or public-facing work, and set clear check-in points before execution.
The agent could change local project files or run project-local checks when the local-repo adapter is used.
The local repository adapter can modify project files and run local verification commands. That is expected for a repo-orchestration workflow, but it is a meaningful capability if pointed at the wrong path or command set.
- Create/update artifacts, plans, and implementation files. - Run local verification steps when available.
Limit the adapter to intended repo paths, keep work under version control, and require approval before running unfamiliar commands or writing to sensitive repositories.
If authorized, the agent may read or update GitHub issues, pull requests, and repository information.
The GitHub adapter may use repository credentials with read or write permissions. This is purpose-aligned for issue and PR coordination, and the artifact says scope should depend on the task.
- Read/write issues. - Read/write pull requests. - Read repository metadata and files. ... - Require GitHub credential with appropriate repository scopes.
Use least-privilege, repo-scoped credentials; prefer read-only access unless writes are needed; and review any issue or PR updates for public or shared repositories.
Project goals, assumptions, repo paths, decisions, and change history may persist in the hub and affect later work.
The skill uses a persistent hub file to guide later phases. That is central to its purpose, but inaccurate, stale, or overly sensitive hub content could influence future execution.
Use this as the central state file (`alignment-hub.md`). ... `intent_snapshot` ... `assumptions` ... `adapters` ... `decision_log` ... `change_log`
Keep the hub project-local, avoid storing secrets, review it before major phases, and reset or archive it between unrelated tasks.