Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign because it found no clear malicious behavior, while noting undeclared capabilities and an installer instruction that runs a downloaded script; the evidence is incomplete.
The verdict is benign, but consider whether the reported build-thread and genealogy actions fit your needs, and review the Bun installation method before following it. The scan was partial because it could not resolve several local references, so the evidence is incomplete.
Although the code uses the declared do CLI, its concrete behavior is posting repository/build coordination messages, not managing the described personal tasks, habits, or life-tracking entities. This thread-posting capability is not disclosed in the description. Neither command is destructive, so the absence of --allow-destructive is not itself a mismatch.
The commands use the declared CLI, but perform genealogy-specific writes rather than the described task/habit operations or entity reads. Mentioning contacts as readable entities does not adequately disclose importing family-tree data, assigning identity, or accepting person matches. The chunk does not demonstrate any destructive-authorization bypass.
The installation instructions pipe a remotely fetched, mutable shell script directly into bash without an independent integrity check or review. If the installer endpoint or its delivery infrastructure is compromised, following this instruction executes attacker-controlled code with the invoking user's privileges, potentially exposing API keys and local files; the legitimate Bun domain and optional installation context reduce suspicion of malicious intent but do not eliminate the execution risk.
(https://github.com/robbeverhelst/do/releases) and put it on your `PATH`.
Requires **Bun ≥ 1.3** for the `bunx`/binary paths (`bun --version`; install with
`curl -fsSL https://bun.sh/install | bash`).
## Auth (do this first)