orbcafe-pivot-ainav
PassAudited by ClawScan on May 1, 2026.
Overview
This instruction-only ORBCAFE UI helper is coherent and purpose-aligned, with only expected considerations around voice-ASR configuration and optional preset persistence.
This skill appears safe to install as an instruction-only development helper. If you use its voice-navigation recipe, confirm where voice data or transcripts are sent and how ASR authentication is configured. If you use pivot preset persistence, scope saved presets carefully and provide users a way to manage them.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If implemented, voice input may be sent to a configured ASR service or local endpoint.
The voice-navigation example configures a WebSocket ASR endpoint. This is expected for voice input, but the endpoint may receive voice-derived data or transcripts depending on the application.
wsUrl="ws://localhost:8765"
Use a trusted ASR endpoint, configure auth outside source code, and make clear to users when voice capture or transcription is active.
Saved pivot presets could persist business analytics layouts or user preferences across sessions.
The skill recommends storing pivot presets either server-side or locally. This is aligned with preset management, but persisted analytics configuration can affect future sessions.
If presets are business assets, persist server-side via `onPresetsChange` sync. If presets are personal preferences only, local storage is acceptable.
Scope persisted presets by user, tenant, and page; avoid storing sensitive data in preset names or configuration; and provide a way to review or delete saved presets.