Back to skill
Skillv0.1.0
ClawScan security
Clear Mind · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
ReviewMar 14, 2026, 4:01 AM
- Verdict
- Review
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions match its stated purpose, but it performs potentially destructive file moves/deletions (modifying MEMORY.md and creating/moving files under /memory/) and could do so autonomously without per-migration confirmation — proceed with caution.
- Guidance
- This skill is coherent with its purpose, but it will move and delete content from your MEMORY.md and create files under /memory/facts/. Before installing: (1) back up your current MEMORY.md and any /memory/ directory; (2) require the agent to ask for explicit confirmation for each migration or run the skill only manually; (3) test the migration on a copy in a sandbox workspace; (4) review the exact migration rules and filenames (critical-events.md, projects.md, etc.) to ensure nothing you need will be removed; (5) restrict autonomous invocation if you don't want the agent to modify memory files without per-run approval.
Review Dimensions
- Purpose & Capability
- okThe name and description (memory maintenance, migrate factual content out of MEMORY.md) align with the instructions which read MEMORY.md and migrate facts into memory/facts/; no unrelated credentials, binaries, or installs are requested.
- Instruction Scope
- concernRuntime instructions tell the agent to read MEMORY.md, create /memory/facts/ files, move factual content, and delete redundant/outdated content. Those actions are within the tool's purpose, but they are inherently destructive and the SKILL.md requires only a single 'first-run user check' rather than per-migration confirmations. The rule 'DELETE' and automated migration rules could remove user data if misapplied.
- Install Mechanism
- okNo install spec or code is present (instruction-only), so nothing will be downloaded or written to disk by an installer. Lowest install risk.
- Credentials
- okThe skill requests no environment variables, credentials, or external config paths. All file operations are scoped to MEMORY.md and /memory/, consistent with its stated purpose.
- Persistence & Privilege
- notealways:false (not forced into all agents). However, disable-model-invocation is false (normal), so the agent could invoke this skill autonomously and perform file writes/deletes. Combined with the destructive migration rules and only a single initial confirmation prompt, this raises a moderate risk if the agent is allowed to run without stricter user controls.