Incident Replay
ReviewAudited by ClawScan on May 1, 2026.
Overview
The skill is coherent for local incident forensics, but it deliberately copies workspace files, logs, and agent memory into persistent local snapshots, so users should scope it carefully.
Before installing or using this skill, choose a narrow workspace root, exclude secrets or large private folders, and protect the generated incident_data directory. The behavior appears aligned with local incident forensics, but its usefulness comes from copying and retaining potentially sensitive local content.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Local incident snapshots and reports may contain secrets, configs, prompts, logs, or agent memory. If the incident_data directory or reports are shared, synced, or backed up, that data may be exposed.
The core workflow stores workspace file contents, logs, and memory-derived decision chains for later analysis. This is purpose-aligned, but it can retain sensitive data or untrusted log/memory text.
Take point-in-time snapshots of your workspace (files, sizes, hashes, content) ... Extract decision chains from agent logs and memory files ... Incident database with persistent storage
Set WORKSPACE_ROOT narrowly, customize INCLUDE_PATTERNS and EXCLUDE_PATTERNS, keep incident_data private, and review or redact reports before sharing them.
A user may see this as an instruction-only skill, but practical use involves executing local Python code from the package.
The skill relies on running included Python helper scripts even though the registry metadata lists no required binaries and no install spec. The code execution is disclosed and central to the purpose, but the runtime requirement is under-declared.
python3 incident_capture.py --config incident_config.json --snapshot --label baseline
Review the included scripts before use and run them only in the intended workspace; the package metadata should declare Python as a required runtime.