simplify-and-harden

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent and bounded; it can automatically review and lightly edit recent code changes, but the artifacts do not show hidden data access or malicious behavior.

This looks safe to install if you want an automatic post-completion code review pass. Before using it broadly, make sure you are comfortable with the agent applying small cleanup and security edits without per-edit approval, and always review the final diff before merging.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence
ASI01: Agent Goal Hijack
What this means

The agent may spend extra time reviewing and changing code before it tells you the task is done.

Why it was flagged

The skill deliberately changes the agent's stopping condition by inserting a post-completion review before the final response.

Skill content
The skill activates automatically when ALL of the following are true ... The agent signals task completion ... The diff contains a non-trivial code change
Recommendation

Use it when you want this post-completion review flow, and use the documented skip option when you do not.

What this means

Small automatic edits could still affect code behavior or introduce regressions if the agent misjudges a fix.

Why it was flagged

The skill permits the agent to make source-code edits without separate approval for each cosmetic or simple security patch.

Skill content
In interactive mode, apply these cosmetic fixes automatically ... In interactive mode, apply simple security patches ... automatically.
Recommendation

Review the final diff and test results after the skill runs, especially for security patches that change logic.

What this means

Installing from an external source means you are trusting that repository and the package resolution path.

Why it was flagged

The documentation includes a user-directed install command that fetches a skill from an external repository-style source.

Skill content
npx skills add pskoett/pskoett-ai-skills/simplify-and-harden
Recommendation

Verify the repository/source and prefer a trusted, pinned installation path if available.

What this means

Once added to an agent context file, the behavior may persist across future sessions and affect later coding work.

Why it was flagged

The skill provides instructions meant to be stored in persistent agent context files and reused across future coding tasks.

Skill content
Use these snippets to wire Simplify & Harden into your active agent context file.
Recommendation

Add the snippet only to projects where this workflow is desired, keep the scope limits intact, and remove it if it no longer matches your workflow.