REGULATORYCHANGEMONITOR

PassAudited by ClawScan on May 4, 2026.

Overview

This instruction-only skill is coherently scoped to checking public regulator websites and keeping a small local run-state file, with no credential use, purchase flow, or harmful action shown.

This looks reasonable for a regulatory monitoring helper. Before installing, decide whether you want it to run on a schedule, keep any added regulator URLs to trusted sources, and treat the generated digest as an early-warning summary rather than final compliance advice.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent will retrieve and summarize public web content; inaccurate or untrusted source content could affect the digest, though this is central to the skill’s purpose.

Why it was flagged

The skill relies on browsing external regulator pages and linked documents to perform its stated monitoring task.

Skill content
“Fetch the news/publications page” ... “If the full document is linked and short (<10 pages), read it”
Recommendation

Use trusted regulator URLs, review summaries before acting on them, and avoid adding arbitrary untrusted sources.

What this means

The state file stores minimal run metadata, but if it is edited or corrupted the agent might miss updates or produce duplicate alerts.

Why it was flagged

The skill maintains persistent local state to decide what to scan next.

Skill content
“After each run, create or update `last-run.md` in the skill directory” ... “last_run: [ISO timestamp]”
Recommendation

Keep the skill directory writable only by trusted users and inspect or reset `last-run.md` if the digest seems incomplete.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

If the host honors the schedule, the skill may run automatically each morning and browse regulator pages without a fresh prompt.

Why it was flagged

The artifact describes routine scheduled operation, although no installer or code implementing scheduling is supplied.

Skill content
“trigger: scheduled (daily at 7am) + on-demand”
Recommendation

Confirm whether scheduled invocation is enabled in your environment and disable or limit it if you only want manual runs.