v1.0.0

MLX Swift LM Expert

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:15 AM.

Analysis

This documentation-only MLX Swift skill appears coherent and benign, with normal cautions around model downloads, optional Hugging Face tokens, tool calling, and local prompt/document storage.

GuidanceThis skill is an instruction/reference package rather than executable code. Before relying on it, verify the source of any Swift package or model repository you use, prefer pinned model revisions, keep credentials out of code, and add confirmation checks before connecting model tool-calling to actions that modify files, accounts, money, or public content.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

references/tool-calling.md

case .toolCall(let toolCall): ... let result = try await toolCall.execute(with: weatherTool)

The documentation shows a model-generated tool call being executed through an application-defined handler. This is central to the stated tool-calling feature, but high-impact tools should still require validation or user approval.

User impactIf a developer connects this pattern to real tools such as file operations, payments, or account changes, model output could trigger those handlers unless the app adds safeguards.

RecommendationUse typed, narrowly scoped tools; check the requested tool name and arguments; and require human confirmation for destructive, financial, public-posting, or account-changing actions.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

references/model-container.md

Download: Model weights fetched from HuggingFace (cached locally)

The skill documents loading third-party model artifacts from Hugging Face and caching them locally. This is expected for MLX model usage, but model provenance and revisions affect trust.

User impactUsing an untrusted or changing model repository could affect model behavior or compatibility.

RecommendationUse trusted model repositories, pin specific revisions when possible, and review model licenses and provenance before using models with sensitive data.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

references/model-container.md

let hub = HubApi(hfToken: "your_token") ... configuration: .init(id: "private/model")

The documentation includes an optional Hugging Face token for private model access. This is purpose-aligned, with no evidence of logging or unrelated transmission, but it is still account credential use.

User impactA Hugging Face token could grant access to private model repositories depending on its scope.

RecommendationUse least-privilege tokens, avoid hardcoding real tokens in source files, and rotate tokens if they are exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

references/kv-cache.md

try savePromptCache( url: fileURL, cache: cache, metadata: ["prompt": "My cached prompt"] )

The docs show saving prompt cache state with prompt metadata. This is an expected performance feature, but it can persist sensitive prompts or reused context locally.

User impactPrompts, cached context, or retrieved documents may remain on disk if an application uses these examples directly.

RecommendationStore caches and vector indexes only in intended locations, avoid saving sensitive prompts unnecessarily, and clear or protect cached context when it is no longer needed.