Litho Doc

PassAudited by ClawScan on May 16, 2026.

Overview

Litho Doc is a coherent instruction-only documentation generator; the main caution is that it reads a codebase and stores temporary local analysis notes while producing docs.

This skill appears safe for its stated purpose, but it works by reading your project and writing local documentation and temporary analysis files. Use it only on repositories you want analyzed, keep secrets out of the project tree where possible, choose a clear output location, review the generated docs before sharing them, and delete `.litho-agent/` when you no longer need the intermediate reports.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may read many source and configuration files in the selected project and include internal architecture details in generated documentation.

Why it was flagged

The skill instructs the agent to inspect repository files using listing, reading, semantic search, and grep. This is expected for documentation generation, but it is broad local file access.

Skill content
小 | <100 源文件 | `list_files` 递归 + `read_file` 全部核心文件 ... 中 | 100-500 源文件 | ... `codebase_search` ... 大 | >500 源文件 | ... `grep_search`
Recommendation

Run it only on the intended repository, avoid including secrets or unrelated private files, and review the generated documentation before sharing it.

What this means

Temporary local notes may preserve details about the codebase after the task finishes, and stale notes could influence later documentation runs if reused.

Why it was flagged

The skill stores intermediate analysis reports on disk and may retain them after completion. These files can contain source-derived architecture notes and may be reused later if left in place.

Skill content
每完成一个研究 Step → `write_to_file` 写入 `.litho-agent/` 对应文件 ... 最终输出完成后 → 删除 `.litho-agent/` 临时目录(可选保留供复查)
Recommendation

Delete `.litho-agent/` after review if you do not need the intermediate reports, and avoid running the skill in directories containing confidential material outside the target project.