IQ Skill

PassAudited by ClawScan on May 4, 2026.

Overview

This appears to be a coherent IQ-test and puzzle generator with no evidence of credential use, network access, hidden behavior, or purchase activity, though generated files should be handled carefully.

This skill looks safe for generating puzzles and IQ-style practice content. Before installing, note that it can create local files and interactive HTML pages; save outputs in a safe folder and review generated HTML if it includes custom content from another person or source.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Opening a generated quiz is expected to run browser JavaScript; unsafe custom content could potentially change what that page does.

Why it was flagged

The HTML template intentionally runs client-side JavaScript and uses placeholders that will be replaced with generated quiz content. If untrusted custom content is inserted without proper JSON/HTML escaping, the resulting local HTML could run unexpected script.

Skill content
<h1>{{TEST_TITLE}}</h1> ... <script> const questions = {{QUESTIONS_JSON}};
Recommendation

Only embed trusted quiz content, escape titles/questions/options correctly, and review generated HTML before opening or sharing it.

What this means

If the agent is asked to save output to the wrong location, it could overwrite a local file.

Why it was flagged

The script can write generated challenge output to a user-supplied file path. This is purpose-aligned, but the path is not constrained in the visible code.

Skill content
parser.add_argument("--output", help="Output file path (optional)") ... with open(args.output, "w", encoding="utf-8") as f:
Recommendation

Use a dedicated output folder and confirm file paths before saving generated puzzles or quizzes.

What this means

Users have less external context for who authored or maintains the skill.

Why it was flagged

The registry metadata does not provide a source repository or homepage, which limits provenance assurance. The artifacts themselves do not show remote install scripts, unpinned packages, or hidden dependencies.

Skill content
Source: unknown; Homepage: none
Recommendation

Prefer skills with clear provenance when possible, or inspect the included files before relying on them.