research-logger

PassAudited by ClawScan on May 11, 2026.

Overview

This skill appears to do what it says—search the web, find a GIF, and create a Bear note—but users should notice its external lookups and undeclared local dependencies.

Before installing, make sure you trust the grizzly CLI and have the expected Bear-note template in place. Avoid entering sensitive research topics unless you are comfortable with them being sent to web search/GIF services, and review generated Bear notes before relying on them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or require extra local setup that is not fully captured by the registry metadata.

Why it was flagged

The script requires a local template and the grizzly CLI at runtime, while the registry metadata declares no required binaries or config paths. This may cause setup surprises but is consistent with the skill's stated Bear-note purpose.

Skill content

TEMPLATE="$WORKSPACE/notes/research_template.md" ... echo "$FILLED" | grizzly create --title "$TOPIC Research" --tag "$TAGS"

Recommendation

Install grizzly from a trusted source, verify the template file before use, and prefer updated metadata that declares required tools and files.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Research topics may be visible to search, fetch, or GIF services used by the agent environment.

Why it was flagged

The topic is sent to web search and GIF lookup tools, and a selected URL is fetched. These external/provider interactions are disclosed and purpose-aligned, but the exact providers and privacy boundaries are not specified.

Skill content

SEARCH_RESULTS=$(web_search "$TOPIC" ...)
PAGE_CONTENT=$(web_fetch "$TOP_URL" ...)
GIF_RESULT=$(gifgrep "$TOPIC" ...)

Recommendation

Do not use confidential or sensitive topics unless you are comfortable with those queries being sent to the configured providers.

Low

#ASI06: Memory and Context Poisoning

What this means

Generated notes may contain inaccurate, misleading, or adversarial web content that could be trusted later.

Why it was flagged

Content fetched from the web is transformed into a persistent Bear note. This is the intended workflow, but it means untrusted web text can be stored in the user's notes.

Skill content

PAGE_CONTENT=$(web_fetch "$TOP_URL" ...)
...
echo "$FILLED" | grizzly create --title "$TOPIC Research"

Recommendation

Review generated notes and source links before relying on them, sharing them, or using them as future agent context.