Security audit
Security checks for vulnerabilities and agentic risk
ClawScan rates this skill benign because the reported behavior appears aligned with its purpose, while noting some policy and tool-scope issues and incomplete evidence.
The verdict is benign with medium confidence, not a guarantee of safety. Before installing, consider whether English-only output and the detected network and shell capabilities fit your needs. Evidence is incomplete: skillspector could not resolve a local path-like reference, even though it scanned all listed components, and runtime permissions are unknown.
Both the job description and agent payload explicitly require the digest to be in English. The file provides no user opt-in, language choice, or documented justification for this language constraint.
Without declared permissions the skill's intent is opaque and cannot be validated.
The instruction requires the entire digest, including headings, to be written in English. Although the description advertises English output, the skill neither offers a language choice nor explains why this language restriction is necessary.
subprocess module calls execute external commands. Without careful input validation, this enables command injection.
seen = set()
while True:
query = urlencode({**params, "per_page": PAGE_SIZE, "page": page})
result = subprocess.run(
["glab", "api", f"{BASE}/{endpoint}?{query}"],
check=True, capture_output=True, text=True, timeout=30,
)