Long Text Tracker

PassAudited by ClawScan on May 10, 2026.

Overview

This is a coherent instruction-only long-form writing tracker; users should mainly notice that it saves project state locally, uses limited shell commands for file checks, and mentions email delivery.

This skill appears safe for its intended use as a long-text continuity helper. Before using it, choose a clear project folder, review any saved summaries before resuming, and require explicit approval before any email delivery or command outside the documented project workflow.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may read and write local project files and run simple local commands while managing the writing project.

Why it was flagged

The skill exposes local file tools and shell execution. The documented shell use is narrow and purpose-aligned, mainly word counts and read fallback, but users should know local commands may be invoked.

Skill content
tools:\n  - read\n  - write\n  - edit\n  - exec\n  - message ... 字数统计 | exec "wc -m" ... 读取进度/设定/摘要 | read | read返回错误 | exec cat
Recommendation

Keep shell use limited to the documented commands and project files; ask before running arbitrary commands or operating outside the project directory.

What this means

Draft content and summaries may remain on disk and be reused in later writing sessions.

Why it was flagged

The workflow intentionally stores progress files, segment files, and summaries, then reloads those summaries to continue later. This is the core feature, but it creates persistent context that can influence future outputs.

Skill content
projects/{项目名}/ ... 00-进度.md ... segments/ ... summaries/ ... 中断恢复 ... 加载最近3段摘要恢复上下文
Recommendation

Use a dedicated project folder, avoid placing sensitive unrelated data there, and review summaries if they were edited by anyone else before resuming.

What this means

If an email-capable environment is available, generated content could be sent outside the local workspace.

Why it was flagged

The skill mentions sending the finished content by email. This is disclosed and appears to be a delivery step, but no email mechanism, destination handling, or credential requirement is declared in the provided artifacts.

Skill content
汇总检查:... □ 用户最终确认 ... 生成交付:\n□ 合并所有段落\n□ 格式化输出(HTML/Markdown)\n□ 发送邮箱
Recommendation

Only send by email after the user provides or confirms the recipient address and approves the final content.