Clawrma

• Risk level: Low
• Analyzed: Apr 1, 2026, 10:28 AM
• Findings: 0
• Version: 1.0.1

Overview

The skill's declared purpose (web fetch/search/screenshots/inference) matches its instructions and install method; nothing requested or instructed appears disproportionate to that purpose.

This skill appears internally consistent, but before installing: (1) inspect the GitHub repo and the npm package contents (particularly package.json and any postinstall scripts); (2) check the package maintainer and npm download history; (3) be prepared for the CLI to prompt for authentication and to store tokens/config in your home directory—review where/how it stores credentials; (4) if you are uncertain, run the install/use inside an isolated environment (container or VM) or audit the package locally before global installation; (5) be aware 'infer' and account-related commands may require creating an account and could incur costs—review the service's privacy and billing details.