Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill suspicious because its bind mount rewrite guidance may leave existing data unmigrated, and the scan was partial.
Review the mount changes carefully before using the skill on an existing deployment. Check whether the current bind mount directories contain data, back it up, and confirm the new paths work before resuming services. The scan is incomplete because some local path references could not be resolved, so the findings do not establish that all referenced material was inspected.
Code accesses credential files (SSH keys, AWS credentials, etc.). This could indicate credential theft attempts.
env：
./env/[<namespace>/]<name>.env
环境变量外置到 ./env/ 下的 .env 文件，compose 用 env_file 引用。例：./env/new-api.env、./env/common.env。
The skill requires rewriting persistent bind-mount sources without requiring migration or checking whether the original directories contain data. Applied to an existing deployment, this can make services start against empty directories, causing downtime, apparent data loss, or unintended initialization; it does not itself delete the original data. The risk is particularly relevant because converting existing Compose configurations is the skill's stated purpose.