Arrive Guideline Architect
PassAudited by ClawScan on May 1, 2026.
Overview
The skill appears to be a local ARRIVE protocol/checklist generator with no evidence of hidden network access, credential use, persistence, or destructive behavior.
This appears safe to use for local ARRIVE protocol drafting, but only allow it to read or write files you intentionally provide. Review generated scientific, statistical, and ethics content manually before relying on it, and be aware that some documented helper modules are not present in the reviewed files.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used carelessly, the agent could modify or inspect local files beyond the intended protocol documents.
The skill requests broad local file and shell capabilities. This is relevant because the tool could read, edit, write, or run local commands, although the documented purpose is limited to generating and validating protocol files.
allowed-tools: [Read, Write, Bash, Edit]
Use the skill on explicit protocol/checklist files only, and review any proposed file writes or shell commands before allowing them.
Some examples may fail or may require additional files not present in the reviewed package.
The documentation references helper modules and scripts that are not listed in the provided file manifest, which only includes scripts/main.py as code. This looks like incomplete or stale packaging rather than malicious behavior, but users should be aware that some documented commands may not be available.
from scripts.arrive_builder import ARRIVEBuilder ... python scripts/validate.py --input my_protocol.md --format markdown
Prefer the included files and visible scripts, and avoid adding or running unreviewed helper code unless it comes from a trusted source.