Method Dev Agent

ReviewAudited by ClawScan on May 10, 2026.

Overview

Prompt-injection indicators were detected in the submitted artifacts (unicode-control-chars); human review is required before treating this skill as clean.

This skill looks reasonable for a local Streamlit-based chromatography method tracker. Before installing, use a virtual environment, remember that lab records are stored locally in a SQLite database, and avoid running the included publishing script unless you actually intend to push and publish the whole project. ClawScan detected prompt-injection indicators (unicode-control-chars), so this skill requires review even though the model response was benign.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Experiment records, sample details, observations, and method-development knowledge may remain on disk after use.

Why it was flagged

The skill creates and uses a persistent local SQLite database for experiment, compound, and method records.

Skill content
db_path = current_dir / "data" / "method_dev.db"
Recommendation

Use it only in an appropriate project directory, avoid entering confidential lab data unless local storage is acceptable, and back up or delete the database according to your lab policy.

What this means

Running the publisher script could upload local project files to GitHub and ClawHub using the user's logged-in credentials.

Why it was flagged

The included publisher helper can commit, push, and publish the entire project if a user deliberately runs it.

Skill content
git add .
git commit -m "v0.1.0 ready for publish"
git push -u origin main
clawhub publish . --slug method-dev-agent
Recommendation

Do not run the publish script unless you intentionally want to publish this project; review the files that would be committed and pushed first.

What this means

Manual installation may resolve to newer package versions than the author tested.

Why it was flagged

Dependencies are specified with lower-bound ranges rather than exact pinned versions.

Skill content
streamlit>=1.28.0
pandas>=2.0.0
plotly>=5.18.0
numpy>=1.24.0
Recommendation

Install in a virtual environment and consider pinning or reviewing dependency versions for regulated or production lab use.