Back to skill
Skillv0.1.2
ClawScan security
Agent Visio Use · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 20, 2026, 11:43 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally coherent: it only guides an agent to clone/read the DiagForge repo and run repository-provided smoke-test scripts; required binaries and the declared environment variable are consistent with that purpose.
- Guidance
- This skill is a lightweight guide that points agents to the DiagForge GitHub repository and shows which Python smoke-test scripts to run. Before using it: 1) Verify the upstream GitHub repo (https://github.com/qweadzchn/DiagForge) yourself; 2) Understand that the smoke-test commands execute Python scripts from that repo—review those scripts before running them locally; 3) Only set VISIO_BRIDGE_TOKEN if you trust and control a local Visio bridge instance, since it is a sensitive token used to access that bridge; 4) Use HTTPS cloning if you don't want to expose SSH keys; and 5) Be aware that running repository code can perform arbitrary actions on your machine, so run in a controlled environment if you have any doubts.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description match its runtime instructions: it directs an agent to clone a GitHub repo, read specific docs, and run the repository's smoke-test Python scripts. Requested binaries (git, python) are appropriate for those actions.
- Instruction Scope
- okSKILL.md limits the agent to cloning the repo, reading listed docs, and executing the canonical smoke-test commands in the repository. These actions are within the stated onboarding/bootstrap scope. Note: the instructions run Python scripts that live in the external repository, so running them executes code fetched from GitHub (normal for this use case but worth review).
- Install Mechanism
- okThis is an instruction-only skill with no install spec and no code files included in the package—lowest install risk. It relies on existing git/python on PATH and on the upstream GitHub repository for all runtime code.
- Credentials
- noteThe skill declares VISIO_BRIDGE_TOKEN as a required env var. That token is plausible for running bridge-backed smoke tests that interact with Microsoft Visio, but it is not required for cloning or reading the repository. QUICKSTART.md explicitly states the token is only needed for the bridge-backed smoke test and should be set only after verifying the upstream repo. This is a reasonable design, but users should treat the token as a sensitive local credential and only provide it when they intend to run Visio bridge operations.
- Persistence & Privilege
- okThe skill does not request persistent or elevated platform privileges. always:false and disable-model-invocation:false are standard; the skill does not modify other skills or system-wide agent settings.