Startup Guide

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent instruction-only startup guidance skill, with only purpose-aligned notes about using linked skills, web search, and external data lookups.

This skill appears safe to install as an instruction-only startup guide. Before using delegated lookups, make sure you trust the linked skills such as company-info, law-search, tax-guide, and korean-gov-programs, and avoid providing business identifiers unless you are comfortable with them being queried through those integrations.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may run helper commands from other installed skills to gather legal, program, or business-status information.

Why it was flagged

The playbook tells the agent to use local shell/python commands from other skills, with user-provided placeholders for industry or business number. This is aligned with the startup guidance purpose, but it is still tool execution that should be handled with normal user approval and safe argument passing.

Skill content
bash skills/law-search/scripts/law_search.sh "[업종] 허가 신고" 5
python3 skills/korean-gov-programs/scripts/collect_programs.py
bash skills/company-info/scripts/biz_status.sh "[사업자번호]"
Recommendation

Review the linked skills before relying on them, and ensure any user-supplied values are passed as safe arguments rather than concatenated into raw shell commands.

What this means

Results may depend on other skills that are not included in this review.

Why it was flagged

The skill explicitly depends on several other skills for business verification, tax guidance, law search, and support-program lookup. Those dependencies are purpose-aligned, but their code and provenance are outside this artifact set.

Skill content
`company-info`, `tax-guide`, `law-search`, `korean-gov-programs`, `welfare-guide`
Recommendation

Install or enable only trusted versions of the linked skills, especially before allowing command execution or external lookups.

What this means

A business registration number provided by the user may be sent to a linked company-information skill or its underlying lookup service.

Why it was flagged

For business verification, the skill routes a user-provided business registration number to another skill. This is disclosed and relevant to the stated purpose, but it is still inter-skill data sharing.

Skill content
output: "company-info 스킬 호출 → 사업자 상태 조회"
min_data: ["사업자 번호 10자리"]
Recommendation

Only provide business numbers you are comfortable querying, and review the linked company-info skill's handling of lookup data if privacy matters.