Generate Mortgage Broker Team Client Education Handout
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill’s handout-generation purpose is clear, but it allows broad local shell/file tools that are not needed for that purpose and its README points to a mismatched install source.
Before installing, confirm the package/repository identity and consider removing or blocking Bash and Read for this skill. Use it only for drafting handouts, avoid providing confidential client data unless necessary, and review mortgage/financial content for accuracy and compliance before sharing externally.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked, the agent could potentially read local files or run shell commands even though that is not necessary to draft a mortgage handout.
The declared tools allow local command execution and local file reads, but the stated workflow is only to create a client education handout using chat/image generation, with no scoping or approval guidance for those local tools.
allowed-tools: Bash, Read
Remove Bash and Read from the skill unless there is a specific, documented, user-approved need; prefer only chat/image-generation capabilities for this skill.
A user following the README could end up installing content from a different package or repository than the one being reviewed here.
The README points users to a qiaomu package/GitHub repository, while the reviewed registry metadata identifies a toby-prefixed slug; this could cause users to install or inspect a different source than the reviewed artifact.
clawhub install qiaomu-generate-mortgage-broker-team-client-education-handout ... git clone https://github.com/qiaomucom/generate-mortgage-broker-team-client-education-handout.git
Verify the intended ClawHub slug and repository before installing, and update the README so the install commands match the published registry package.