Autonomous Research

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may perform broad information gathering and synthesis based on the user’s topic unless the user gives tighter limits.

Why it was flagged

The skill is explicitly designed to let the agent conduct broad research with limited user guidance. This is purpose-aligned, but users should provide clear boundaries for topics, depth, and acceptable sources.

Skill content
Conduct comprehensive research independently... Information gathering without guidance
Recommendation

Use specific research questions, source constraints, and desired output format when invoking the skill.

What this means

Installing or using the skill may consume the user’s Brave Search API quota or expose searches to that provider.

Why it was flagged

The skill requires a Brave API key for external search/research functionality. This is expected for the stated purpose, but it is still account-linked credential use and is not described as the primary credential in the registry metadata.

Skill content
Required env vars: BRAVE_API_KEY; Env var declarations: none; Primary credential: none
Recommendation

Use a dedicated, least-privileged Brave API key if possible and monitor provider usage.

What this means

Future installs could receive a different axios version than the one the author tested.

Why it was flagged

The install specification pulls an npm package without a pinned version. Axios is a common HTTP client and fits a research/search workflow, but unpinned dependencies can change over time.

Skill content
node | package: axios | creates binaries: axios
Recommendation

Prefer pinned package versions or a lockfile for reproducible installation.