E2E e2e-repro3-1772127182276

Deterministic end-to-end test skill for validating CLI publish lifecycle and verifying registry and metadata round-trips.

Security Scan

The skill's declared purpose (deterministic end-to-end testing of a publish lifecycle) matches its minimal requirements — it is an instruction-only test helper that requests no credentials or installs — but the instructions are very sparse and incomplete.

Purpose & Capability

Name and description claim an e2e test for CLI publish/install/update/delete and registry metadata. The skill requests no binaries, env vars, or installs, which is consistent for a simple instruction-only test helper.

Instruction Scope

SKILL.md contains only high-level steps ('Install the skill', 'Run the listed command examples', 'Confirm output') but provides no concrete command examples or targets. This vagueness gives the agent broad discretion at runtime and is incomplete for a deterministic test — not malicious but potentially risky if you expect automated execution without seeing exact commands.

Install Mechanism

No install spec and no code files — lowest-risk pattern (instruction-only). Nothing is written to disk by installation because there is no installer.

Credentials

The skill declares no required environment variables, credentials, or config paths. There is no indication it needs access to external secrets or systems.

Persistence & Privilege

always is false, user-invocable is true, and model invocation is allowed (normal defaults). The skill does not request persistent presence or elevated system privileges.

Assessment

This skill appears to be what it says — a minimal e2e test helper with no credentials or installs — but the runtime instructions are incomplete (no concrete commands or expected outputs are provided). Before installing or allowing autonomous runs: 1) ask the publisher for the exact command examples and expected output, 2) review those commands yourself to ensure they don't touch systems you don't want tested, and 3) run the test in a sandbox or isolated environment first. If you plan to let the agent invoke the skill autonomously, require explicit, auditable command lists to avoid unintended actions.

e2e-repro3-1772127182276

Purpose

Provides a deterministic end-to-end test skill for the ClawHub publish lifecycle.

When To Use

• validating CLI publish/install/update/delete behavior
• verifying registry and metadata round-trips

Usage

1. Install the skill.
2. Run the listed command examples.
3. Confirm output includes expected status messages.

Notes

This skill is intentionally simple but includes enough concrete guidance to pass quality checks.