FargoRate

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the skill may install or rely on a local fargo command from the referenced Homebrew source.

Why it was flagged

The skill depends on an external Homebrew tap/formula to provide the fargo CLI. This is expected for a CLI-based skill, but it means the installed binary is part of the trusted supply chain.

Skill content

install:
      - kind: brew
        tap: rgstephens/fargo
        formula: fargo
        bins:
          - fargo

Recommendation

Confirm that you trust the Homebrew tap/formula and project source before installing.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

Player history and any contact details stored in the database may remain on your computer and could be reused in later FargoRate queries.

Why it was flagged

The optional database feature stores player data and contact fields locally across runs. This is disclosed and aligned with tracking rating changes, but it creates persistent local data.

Skill content

The `--db` flag enables a local SQLite database that persists player data across runs... email TEXT,
    mobile TEXT,
    telegram TEXT,
    discord TEXT

Recommendation

Use --db only when you want persistent tracking, choose the database path intentionally, and avoid storing contact details you do not need.