Generate Pediatric Dental Clinic Client Education Handout

• Analyzed: May 1, 2026, 8:26 PM
• Findings: 0
• Version: 1.0.0
• Hash: 42facd51bc369fd7b023d7752e0cbf6ea3d09c6ac9482e5755fac7638e89682f
• Source: palm
• External report: View on VirusTotal

Overview

Type: OpenClaw Skill Name: toby-generate-pediatric-dental-clinic-client-education-handout Version: 1.0.0 The skill requests 'Bash' and 'Read' tool permissions in SKILL.md, which are overly broad and unnecessary for the stated purpose of generating dental clinic handouts and images. While the provided instructions and metadata do not contain explicit malicious code or exfiltration logic, the inclusion of shell access (Bash) without a clear functional need represents a significant security risk and potential for exploitation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Concern

What this means

If invoked, the agent may have access to run local commands or read files even though that is not clearly necessary to draft a patient education handout.

Why it was flagged

The skill is described as generating a polished pediatric dental clinic handout, but it grants broad shell and local file-read tools without workflow instructions, scoping, or user-confirmation limits for those capabilities.

Skill content

allowed-tools: Bash, Read

Recommendation

Remove Bash unless there is a documented, user-approved need. Limit Read to explicitly provided files or paths, and document when and why the agent may read local content.

ASI04: Agentic Supply Chain Vulnerabilities

Note

What this means

A user could accidentally install a different copy or source than the one represented by this review.

Why it was flagged

The README gives manual install instructions that point to an external GitHub repository and a different package identifier than the evaluated registry slug. This is not automatic execution, but it creates provenance ambiguity if a user follows the README instead of the reviewed listing.

Skill content

clawhub install qiaomu-generate-pediatric-dental-clinic-client-education-handout
...
git clone https://github.com/qiaomucom/generate-pediatric-dental-clinic-client-education-handout.git

Recommendation

Install from the reviewed ClawHub listing when possible, and verify any external repository or alternate slug before cloning or copying files.