research-assistant

ReviewAudited by ClawScan on May 11, 2026.

Overview

This skill is purpose-aligned for Bear note automation, but it will use your Bear token to batch-edit tagged notes and send derived keywords to GIF or web search.

Before installing, confirm that the 待整理 tag is only on notes you want automatically edited, verify your grizzly token and local tools are set up correctly, and avoid running it on notes whose topics should not be sent to external GIF or web search services.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The skill can add content to every matching Bear note and mark those notes as finalized by removing the 待整理 tag.

Why it was flagged

The workflow intentionally mutates Bear notes and changes their tag state. This is aligned with the skill description, but it is still a meaningful local data modification.

Skill content
Append the GIF as markdown ... grizzly add-text --id <ID> --mode append ... Remove the `待整理` tag by replacing tags
Recommendation

Use it only when you want all notes with that tag processed, and consider reviewing or backing up important notes first.

What this means

Anyone or anything invoking the skill with access to that token may be able to read and edit the targeted Bear notes.

Why it was flagged

The skill depends on a local Bear/grizzly token that can be used to read and modify Bear notes. The token use is disclosed and purpose-aligned.

Skill content
Bear app running with a valid API token (`~/.config/grizzly/token`)
Recommendation

Protect the grizzly token file, confirm grizzly is configured for the intended Bear account, and revoke or rotate the token if you no longer use this workflow.

What this means

The helper script may fail or behave unexpectedly if jq is not installed, even though it is not listed as a required binary.

Why it was flagged

The script uses jq, while the registry requirements only list grizzly. This is an under-declared local dependency, not evidence of malicious behavior.

Skill content
NOTE_COUNT=$(echo "$NOTES_JSON" | jq 'if type == "array" then length elif type == "object" then 1 else 0 end')
Recommendation

Install and verify local tools such as grizzly, jq, and the intended GIF search capability before relying on the skill.

What this means

Private or sensitive research topics could be revealed as search keywords to the GIF/search provider.

Why it was flagged

The skill derives keywords from Bear note content and uses them in GIF or web search. This external lookup is disclosed and necessary for the feature, but may expose note topics.

Skill content
Search for a relevant GIF using gifgrep (or `web_search` + `web_fetch` for a GIF URL) with those keywords.
Recommendation

Avoid using the skill on sensitive notes unless you are comfortable sending derived topic keywords to the configured search service.