Security audit

Competitor Watch

Security checks for vulnerabilities and agentic risk

Overview

Current Template audits use A.I.G MCP and an evidence-only verdict judge. Reports below are the stored evidence for this exact release; historical releases may use earlier scanners.

Final verdict status: benign.

ClawScan rates this skill benign with high confidence: the scans found no AIG issues and treated the single low-risk Skillspector alert as expected for the stated purpose.

The verdict is benign, not risk-free. Skillspector completed analysis of all 19 listed components, but its static analysis did not inspect the PNG image; consider whether that coverage limitation matters for your use.

A.I.G

Stored A.I.G report · Scanner version 0.2.2. Status: clean. Checked Nov 9, 2026 · 7:48 PM UTC.

A.I.G reported 0 findings.

Rule IDs and severity below are scanner evidence, not the final audit verdict. Historical reports may use an earlier scanning pipeline.

No findings were reported. This is not a checklist of independently verified clean rules.

SkillSpector

Historical SkillSpector report · Status: clean · Scanner version 2.12.0.

Findings (4)

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · CLAW.md (reported line 28)May include surrounding context.
md
path: state/config.json - source: workspace/state/index.json path: state/index.json - source: workspace/skills/competitor-research/SKILL.md path: skills/competitor-research/SKILL.md - source: workspace/references/automation.md path: references/automation.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · CLAW.md (reported line 29)May include surrounding context.
md
- source: workspace/state/index.json path: state/index.json - source: workspace/skills/competitor-research/SKILL.md path: skills/competitor-research/SKILL.md - source: workspace/references/automation.md path: references/automation.md - source: workspace/references/evidence.md

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · workspace/AGENTS.md (reported line 5)May include surrounding context.
md
Keep all research and preferences in this dedicated workspace. state/config.json is the authoritative setup; state/index.json records successful page snapshots and reported finding IDs. Preserve existing user edits. Use skills/competitor-research/SKILL.md for a manual brief, scheduled pulse, baseline capture, or fixture demonstration. Use BOOTSTRAP.md for first-run setup. Read references/automation.md before creating or changing the weekly automation. The public Template contains no chosen company, competitors, accounts, research history, or credentials. Collect the baseline and watchlist from the user. Keep the native scheduler as the sole schedule authority and keep exactly one weekly research automation for this agent.

Skill Enumeration

Medium

Category: Agent Snooping
Confidence: 80% confidence
Finding: Skill enumerates or reads other installed skills. Access to other skills' SKILL.md files or the skills directory reveals prompt instructions, capabilities, and secrets that should be invisible to peer skills.
Content: Scanner excerpt · workspace/automations/weekly-pulse.json (reported line 10)May include surrounding context.
json
"sessionTarget": "isolated", "payload": { "kind": "agentTurn", "message": "Run skills/competitor-research/SKILL.md against the user-configured watchlist. If setup is incomplete, return SETUP_PENDING with missing inputs without researching. Write the brief and successful snapshots locally. Return up to five meaningful findings with linked dated evidence and implications. Report partial coverage honestly. Return NO_REPLY only for a fully successful unchanged run. Do not change automations or send messages.", "toolsAllow": ["read", "write", "edit", "web_search", "web_fetch", "session_status"], "timeoutSeconds": 600 },