Rule Spec
Security checks across malware telemetry and agentic risk
Overview
The skill is coherent for managing business-rule files, but it relies on an external npx CLI and can generate persistent agent instructions, so users should verify the package and review generated outputs.
This looks safe to install as an instruction-only skill, but treat the external rulespec CLI as unreviewed code: verify the npm package, run it only in the intended workspace, and inspect generated SKILL.md files before letting an agent load them.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Running the documented commands may execute external package code that was not included in this review.
The skill depends on a runtime-downloaded npm CLI rather than code included in the reviewed artifacts. This is disclosed and central to the purpose, but users should verify the package source/version.
All commands use `npx rulespec` — no global install needed. npx downloads and runs it automatically.
Use a trusted or pinned rulespec package version when possible, and run it in the intended project workspace.
Using the wrong file or output path could include sensitive example data or overwrite generated rule artifacts in an unintended location.
The documented CLI can read user-specified files and write generated output to user-specified directories. That is expected for this rule-management workflow, but path choices matter.
`JSON file path`: `/path/to/data.json` — file is read and parsed ... `rulespec emit --outdir <path>`
Review file paths before running commands, avoid sensitive example data unless needed, and keep generated outputs under version control or backups.
Generated rules may become part of an agent's future instructions and affect decisions beyond the current editing session.
The skill intentionally creates persistent agent-loadable instructions. This is purpose-aligned, but incorrect or adversarial rules could influence later agent behavior.
The output is a structured SKILL.md that any AI agent can load. ... `enforce` — mandatory. Agent must follow this rule.
Review generated SKILL.md files and any included examples before loading them into agents, especially for enforce-level rules.