IFQ App Builder
PassAudited by ClawScan on May 11, 2026.
Overview
The shown files describe a local prompt-bundle generator with workspace-scoped Node checks; no credential or network misuse is evident, but the marketplace capability signals conflict with the package's no-credentials claims.
Install this only if you want a local app prompt-bundle generator. Expect it to write a `*.prompt.md` file and possibly run the documented `npm run verify:lite` check. Do not give it wallet keys, OAuth tokens, API keys, signing certificates, or other secrets; the provided workflow should not need them. Because some listed files were truncated or omitted from the supplied review context, re-scan the full package before relying on this as a complete source audit.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may create a prompt file in the active workspace and run the listed local Node verification command.
The skill asks the agent to write a local workspace file and run a local Node verification script. This is purpose-aligned, but it is still real filesystem and shell authority.
Fork the matched `*.prompt.md` template into the user's workspace ... Verify with `npm run verify:lite -- <bundle.prompt.md>` when shell is available.
Allow shell only for the documented npm scripts and review the generated file path before accepting workspace writes.
A user could be confused into thinking wallet, OAuth, or other secrets are needed, even though the shown Tier 0 workflow does not require them.
The registry-level capability signals imply sensitive credentials, wallet access, or OAuth, while the package metadata and documentation say no credentials are required. The provided code does not show credential collection or use, so this is best treated as an inconsistency to clarify.
Requirements: Required env vars: none; Primary credential: none ... Capability signals: crypto; requires-wallet; requires-oauth-token; requires-sensitive-credentials
Do not provide credentials to this skill. Maintainers should remove false capability signals or document any future credentialed mode separately.