Turn your code scan findings into search queries — research existing implementations before consulting an attorney. NOT legal advice.
Security Analysis
high confidenceThe skill is internally consistent with its stated purpose: it is an instruction-only validator that generates search queries and research strategies from scanner output and requests no credentials, binaries, or installs.
The name/description (generate search queries / research strategies for scanner findings) matches the SKILL.md. It asks for scanner output (patterns.json) and outlines generating queries for patents, GitHub, Stack Overflow, etc. No unrelated credentials, binaries, or installs are requested.
The SKILL.md repeatedly emphasizes it will only generate search strategies and not perform searches. It also describes mapping evidence types (source lines, commits, design docs). That is coherent if the user supplies the scanner output with those references; however, the skill assumes the user will provide the underlying evidence rather than the agent autonomously fetching repositories or external resources. This is a design assumption to be aware of.
No install spec and no code files — instruction-only. Nothing is written to disk or downloaded as part of the skill installation.
The skill requests no environment variables, secrets, or config paths. The metadata and instructions do not require credentials for external services; that matches the stated behavior (generate queries only).
always is false and there are no claims of modifying other skills or system config. The skill does not request permanent presence or elevated privileges.
Guidance
This skill appears coherent and low-risk from an installation/permission standpoint because it only generates search queries and asks users to supply scanner output. Before using it: (1) Remember it is NOT legal advice — consult a patent attorney for legal conclusions. (2) Be careful about the scanner input you paste: do not paste proprietary source code, secret keys, or private identifiers into the agent if you plan to run generated searches on public services, as that could leak sensitive data. (3) The skill says it will not perform searches, but verify how your agent runs skills and whether it will autonomously contact external search engines — if you want to prevent automatic searches, keep the skill user-invoked and avoid giving the agent external-network access for these queries. (4) If you expect the validator to include commit history or design docs, ensure you provide those references explicitly; the skill does not instruct the agent to fetch repositories on its own. If you want stronger assurance, inspect how your agent logs or stores inputs/outputs so sensitive scanner output is not retained or transmitted.
Latest Release
v1.4.0
- Version bumped to 1.4.0 with no functional or content changes. - No file changes detected; skill behavior and documentation remain unchanged.
More by @leegitw
Published by @leegitw on ClawHub
