Back to skill
Skillv0.1.0
ClawScan security
OpenClaw Recovery Drill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 3:44 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and required inputs are consistent with a local recovery-readiness checker that scans workspace and backup directories; it does not request credentials or perform network calls.
- Guidance
- This skill appears to do what it says: a local readiness audit that inspects workspace and backup directories and prints a JSON report. Before running, review scripts/recovery-drill.mjs yourself and run the tool against an explicit safe test workspace (use --workspace and --backup-root) so it doesn't scan unexpected locations under your home. Be mindful that the output includes filenames, modification times, and sizes (potentially sensitive metadata); do not share results publicly. Ensure you have Node >=18 installed and run tests (npm test) if you want to validate behavior in a disposable environment first.
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md, README, package.json, and the scripts all align: the tool inspects a local OpenClaw workspace and candidate backup roots to score recovery readiness. The included tests exercise the same behavior.
- Instruction Scope
- okRuntime instructions only run the bundled Node script against a workspace and optional backup-root. The script's actions are limited to local filesystem discovery and metadata collection (file existence, mtime, sizes). There are no commands to read unrelated system configuration, call external endpoints, or perform restores by default.
- Install Mechanism
- okNo install spec; this is instruction-plus-local code. package.json targets Node >=18 and provides test and bin entries. No downloaded archives, remote installers, or third-party package installs are invoked by the skill itself.
- Credentials
- noteThe skill declares no environment variables or credentials, which is appropriate. The script does read the user's home directory (os.homedir()) and common OpenClaw paths if no explicit workspace/backup-root is provided, and it collects filenames, timestamps, and file sizes — information that can include sensitive filenames or metadata. This behavior is proportional to a discovery audit but users should be aware it inspects local files.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system privileges or modify other skills or global agent configuration. It only reads local files and prints JSON; it exits with status codes but performs no automatic restores or network exfiltration.