Skylv Bot Factory

AdvisoryAudited by Static analysis on May 1, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using these templates to build real agents could affect customer money, CRM data, or deployment systems unless approvals and scopes are added.

Why it was flagged

The skill's templates describe tools that could mutate business records, process refunds, or affect deployments if a user later implements them. In this artifact they are only blueprint examples, not executable capabilities.

Skill content

- refund_process: 处理退款
- crm_update: 更新 CRM 记录
- ci_cd_setup: CI/CD 流水线

Recommendation

Treat the templates as design guidance only; require explicit user approval, scoped credentials, audit logs, and rollback paths before connecting any real refund, CRM, publishing, or deployment tools.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may be harder to verify or compare against its registry listing, and some referenced documentation was not available for review.

Why it was flagged

The registry metadata identifies the package as skylv-bot-factory v1.0.0, while the SKILL.md frontmatter identifies a different slug/version and references related files not present in the manifest. This is a provenance/review-context inconsistency, though no executable code is included.

Skill content

name: agent-builder
slug: skylv-agent-builder
version: 2.0.2
...
- [agency-agents](./agency-agents.md)
- [multi-agent-orchestrator](./multi-agent-orchestrator.md)

Recommendation

Confirm you are installing the intended package version and do not assume the missing referenced files were reviewed.