Symptom

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI06: Memory and Context Poisoning

What this means

Health details you log can remain on your computer in local text files and may be searched or exported later.

Why it was flagged

The script persistently stores timestamped symptom/activity entries in a local directory.

Skill content

DATA_DIR="${HOME}/.local/share/symptom" ... _log() { echo "$(date '+%m-%d %H:%M') $1: $2" >> "$DATA_DIR/history.log"; }

Recommendation

Only log information you are comfortable storing locally; protect, back up, or delete `~/.local/share/symptom` as appropriate.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The command may not be installed by the registry, and any manual script installation would rely on the user trusting the included source.

Why it was flagged

This is notable because the SKILL.md examples assume a `symptom` command and the manifest includes `scripts/script.sh`, so the CLI installation/provenance path is not fully declared.

Skill content

No install spec — this is an instruction-only skill.

Recommendation

Install or run the CLI only from the stated source, review the script before use, and avoid running it with elevated privileges.