instant-execution-discipline

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent may begin actions such as publishing, releasing, or running delegated/background work before the user has a chance to review the exact plan.

Why it was flagged

The skill directs immediate invocation of tools, subagents, or cron before explanation, without defining scope limits or confirmation requirements for high-impact execution tasks.

Skill content
Start execution first. - Trigger tools/subagent/cron immediately before long explanations.
Recommendation

Use only for clearly approved tasks, and add explicit confirmation requirements for public, destructive, financial, account-changing, or long-running actions.

What this means

A one-time delay could cause lasting changes to how the agent behaves in later sessions or tasks.

Why it was flagged

The skill instructs the agent to make persistent changes to controlling instructions, including MISSION or the skill itself, after a delay; this is broader than completing the user's immediate task.

Skill content
If a delay occurs, immediately: ... apply a permanent rule update (MISSION or this skill), ... log the change in `memory/YYYY-MM-DD.md`.
Recommendation

Require explicit user approval before changing MISSION, skill files, or other persistent agent rules; prefer a temporary postmortem note unless the user approves a permanent policy change.

What this means

Operational or business details may be stored and reused later by the agent or appear in the user's Obsidian notes.

Why it was flagged

The skill creates persistent memory and note entries containing shipped work, measurable results, next actions, and evidence pointers.

Skill content
Record KPI in `memory/YYYY-MM-DD.md` ... Mirror the same KPI block to Obsidian daily note.
Recommendation

Confirm that persistent KPI logging is desired, avoid including secrets or sensitive business data, and define where Obsidian notes and memory files are written.