Decide Fit First

• Core job: Scan Clawdbot and MCP skills for malware, spyware, crypto-miners, and malicious code patterns before you install them. Security…
• Best fit: Use it when the task has reusable inputs, steps, and validation criteria rather than a one-off answer.
• Avoid forcing it: If the source lacks commands, platform support, or external-service evidence, keep those fields unknown instead of guessing.

Design Intent

• Structure: The skill is organized around “Capabilities”, “Usage”, “Command Line”, “Within Clawdbot”, showing how the author expects the agent to judge fit, collect context, and produce verifiable output.
• Trigger evidence: Prioritize the author’s wording around when to use it, what context to collect, and what output shape to produce.
• Evidence boundary: Author text states facts, repository files prove commands and paths, and Fluxly only adds fit, limits, and usage judgment.

How To Use It

• Inputs: Provide target material, scope, expected result, forbidden changes, and validation method.
• Invocation: Name skill-scanner directly; if the source includes slash commands, start with the command and then add task context.
• Validation: Start small and check whether the result follows “Capabilities / Usage / Command Line” before expanding.

Boundaries And Review

• Dependencies: It usually needs no extra API key, so start with a small validation task.
• Permissions: Declared permissions include read / shell-exec; ask the agent to state file, command, and rollback boundaries before acting.
• Quality bar: A useful result names the deliverable, evidence, and next action. Generic prose means the task needs tighter context.