Persona Pack Builder
Analysis
This appears to be a benign persona/prompt-packaging skill, with the main caveat that its optional generator writes local files and references template files that are not included in the manifest.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
output_dir = Path(args.output).resolve(); output_dir.mkdir(parents=True, exist_ok=True) ... dest.write_text(rendered, encoding='utf-8')
The helper writes multiple generated files into a user-provided output path. This is directly aligned with generating a persona pack, but it can overwrite same-named files if aimed at an existing directory.
template_dir = script_dir.parent / 'assets' / 'templates'
The script expects bundled templates under assets/templates, while the provided manifest does not include that directory. This suggests an incomplete package or broken optional helper, not hidden malicious behavior.
