v1.0.0

L6 Learning Accelerator

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:58 AM.

Analysis

The skill is self-contained and matches its learning-memory purpose, with the main caution that its progress import/export functions can read or write user-chosen JSON files.

GuidanceThis appears safe to install for local learning progress and time-aware retrieval. Before using export or import, choose a specific workspace JSON file, avoid sensitive system paths, and only import progress files you trust.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

src/progress.js

fs.writeFileSync(filePath, JSON.stringify(data, null, 2)); ... JSON.parse(fs.readFileSync(filePath, 'utf8'))

The progress backup/restore functions read and write a caller-supplied file path. This is disclosed and aligned with exporting progress data, but unsafe paths could overwrite local files or import unintended JSON data.

User impactIf used carelessly, the agent could save progress data over an important file or load progress state from an untrusted JSON file.

RecommendationUse a dedicated workspace file for exports/imports and confirm the path before allowing the skill to write or load progress data.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

src/progress.js

sessions.push(session); ... if (data.sessions) sessions = data.sessions; if (data.milestones) milestones = data.milestones;

The skill stores learning sessions and can replace them from imported JSON. This is expected for progress tracking, but imported or user-supplied session data can shape later reports.

User impactPrivate study notes may be stored in progress data, and untrusted imports could make reports inaccurate.

RecommendationAvoid importing progress files from untrusted sources and review exported files before sharing them.