GEB Aesthetics

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a creative narrative/aesthetics skill with simple local scaffolding scripts, with minor packaging/provenance inconsistencies users should notice.

This skill looks safe for creative use, but install it from a source you trust and be careful when running the init script so it writes only to the project folder you intend.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

If run with an unintended absolute or parent-directory path, it could create or replace a README in the wrong local project folder.

Why it was flagged

The script writes directories and a README to the path supplied as the project name. This is purpose-aligned scaffolding, but the user-controlled path determines where files are created or overwritten.

Skill content

mkdir -p "$PROJECT_NAME"/{L1_Worldview,L2_Character,L3_Narrative,L4_Beat,L5_Execution,assets}

cat > "$PROJECT_NAME/README.md" << EOF

Recommendation

Run the initializer only from a trusted workspace and pass a new, intended project directory name.

NoteMedium Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may not run as advertised via the declared executable, and users may need to verify the actual source package before relying on it.

Why it was flagged

The package declares a bin executable and packaged bin directory, but the provided file manifest does not include a bin/ file. This is a packaging/provenance inconsistency rather than evidence of hidden behavior.

Skill content

"bin": {
    "geb-aesthetics": "./bin/geb-aesthetics"
  },
  "files": [
    "bin/",
    "scripts/",

Recommendation

Confirm the installed package contents and source repository match the registry entry before using any executable entry point.