Swipe File Generator

PassAudited by ClawScan on May 1, 2026.

Overview

The skill clearly fetches user-supplied URLs, analyzes them, and writes a local swipe file; its external fetching and local persistence are disclosed and proportionate.

This skill appears safe for its stated purpose. Before installing, be aware that it will fetch the URLs you provide, may use FxTwitter for Twitter/X links, and will keep a local swipe-file directory containing processed URLs and generated analyses.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

When analyzing Twitter/X links, the tweet username and status ID may be shared with api.fxtwitter.com to retrieve content.

Why it was flagged

Twitter/X URLs are transformed and sent to an external third-party API. This is disclosed and purpose-aligned, but users should know those URL details leave the local workspace.

Skill content

**Twitter/X URLs:** Use FxTwitter API ... **API Endpoint:** `https://api.fxtwitter.com/{username}/status/{tweet_id}`

Recommendation

Use this skill with URLs you are comfortable fetching through the stated services, especially for non-public or sensitive links.

Low

#ASI06: Memory and Context Poisoning

What this means

URLs, titles, timestamps, and generated analyses may remain in the local swipe-file directory after the task completes.

Why it was flagged

The skill stores processed URL history and generated analyses in local files for reuse across runs. This persistence is expected for a swipe-file workflow, but it means analyzed content remains on disk.

Skill content

- **Digested Registry:** `swipe-file/.digested-urls.json`
- **Master Swipe File:** `swipe-file/swipe-file.md`

Recommendation

Review or delete the swipe-file directory if it contains sensitive sources or analyses you do not want retained.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Users have less publisher context for assessing the origin of the instructions.

Why it was flagged

The registry does not provide a source repository or homepage. Because this is an instruction-only skill with no install spec or code files, the provenance gap is limited but still worth noticing.

Skill content

Source: unknown
Homepage: none

Recommendation

Install only if the visible SKILL.md instructions match your intended use and you are comfortable with the listed author metadata.