Scaffold Project

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a benign local project-scaffolding skill, with low-impact cautions about a hard-coded workspace path and README handling bug.

This skill is appropriate if you want a simple local project scaffold. Review or fix the hard-coded /Users/ton path first, especially if your workspace is under a different user account, and correct the README.md handling so the skill creates a file rather than a directory.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

The skill may write to a workspace path that is not yours, or it may fail by creating README.md as a folder instead of a file.

Why it was flagged

The script performs local file creation as expected, but it hard-codes a specific user's home directory and includes README.md in the directory-creation loop before writing README.md as a file.

Skill content

const projectDir = path.join('/Users/ton/.openclaw-workspace/projects/mission-control'); ... 'README.md' ... fs.mkdirSync(path.join(projectDir, dir), { recursive: true });

Recommendation

Before use, adjust the script to resolve the current user's home directory and remove README.md from the folder-creation loop so it is only written as a file.