Skill Registry | 技能注册表

PassAudited by ClawScan on May 1, 2026.

Overview

This is a local, instruction-only skill registry with no code, network, or credential requirements, but it does ask you to add persistent routing rules that can influence future agent behavior.

This skill appears safe to install if you want local trigger-word routing. Before adding it, review the RULES snippet, use narrow trigger words, keep REGISTRY.md under your control, and require confirmation before any matched skill performs high-impact actions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Future agent behavior may change whenever a configured trigger matches, even if the user did not explicitly invoke this registry skill.

Why it was flagged

This intentionally stores routing behavior in persistent agent rule files, so it can affect future tasks until the user removes or edits it.

Skill content
Append `RULES.snippet.md` content to your `RULES.md` or `AGENTS.md`.
Recommendation

Review the rules before appending them, keep a backup of existing RULES.md or AGENTS.md, and remove or narrow the routing rules if they cause unexpected behavior.

What this means

Overbroad or stale trigger words could cause the agent to choose an unintended skill workflow.

Why it was flagged

The skill deliberately routes user requests based on trigger words and delegates execution to local skill instructions. This is the advertised function, but it means routing rules can influence which workflow the agent follows.

Skill content
1. Scan request → Match triggers
2. If matched → Read skills/<name>/SKILL.md
3. Execute per SKILL.md workflow
Recommendation

Use specific trigger words, keep the registry current, and require confirmation before running matched workflows that change files, accounts, public content, or other important state.

What this means

If the registry or referenced SKILL.md files are edited incorrectly or by an untrusted party, the agent may reuse bad routing information later.

Why it was flagged

The registry and skill files are intended to be reused as persistent local context for future responses and routing decisions.

Skill content
When user asks about skills:
1. "All skills" → List by category (brief)
2. Specific domain ... → Return that category only
3. "How to use XX" → Read `skills/XX/SKILL.md`
Recommendation

Only include trusted workspace skills, review changes to REGISTRY.md and SKILL.md files, and avoid treating registry entries as authoritative for high-impact actions without user confirmation.