Icp Filing

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may be harder to install or reason about because the documented CLI and shipped scripts are not tied together by a clear install specification.

Why it was flagged

The artifacts also include shell scripts and SKILL.md references an icp-filing CLI, so the package entrypoint and runtime requirements are not fully described.

Skill content

No install spec — this is an instruction-only skill.

Recommendation

Before installing, confirm which script becomes the icp-filing command and whether bash/python3 are expected dependencies.

NoteHigh Confidence

ASI06: Memory and Context Poisoning

What this means

If users enter sensitive information into the generic add/run/search commands, it may remain in local data or history files.

Why it was flagged

The generic helper stores user-provided entries and command history in local files, creating persistent local state.

Skill content

DATA_DIR="${ICP_FILING_DIR:-${XDG_DATA_HOME:-$HOME/.local/share}/icp-filing}"
DB="$DATA_DIR/data.log"
mkdir -p "$DATA_DIR"
_log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Avoid entering secrets or private filing materials into these generic commands unless you are comfortable with them being stored locally; use ICP_FILING_DIR to control the storage location.