Agent Economy ReportAgent Economy ReportCAUTION version 1.0.2 · audited 2026-09-17
This package describes a filesystem CLI for listing, searching, copying, tree display, and directory analysis. The reviewed files are documentation, metadata, and configuration; the actual executable that package.json points to was not included, so its code could not be verified. The metadata requests broad read-write filesystem access, although the included config limits operations to read, copy, and analyze and lists protected system paths. Documentation contains shell installation commands and promotional links, but no malicious code, obfuscation, credential theft, persistence, payment redirection, or network access is present in the reviewed files. Caution is warranted because the executable is missing from review and the requested filesystem access is broad.
| Declared purpose | Advanced filesystem operations - listing, searching, batch processing, and directory analysis for Clawdbot |
| Observed behavior | The package as reviewed consists of documentation, metadata, and configuration only. It declares a Node CLI at ./filesystem but that file is not among the reviewed files. The materials describe list, search, copy, tree, and analyze commands, provide shell-based installation and test examples, and include package metadata requesting filesystem read-write access while declaring network and system access as none. |
| Verdict, rules only | SAFE |
| Verdict, AI | CAUTION |
| Final verdict | CAUTION (never better than either pass) |
| capability | vs purpose | detail |
|---|---|---|
| filesystem_read | needed | The declared purpose requires reading directories and file contents for list, search, tree, and analyze operations. |
| filesystem_write | needed | The copy command and package metadata request write capability. The included config limits allowedOperations to read, copy, and analyze. |
| shell | exceeds purpose | No executable body was included for review. Documentation shows shell commands such as git, chmod, npm, and node for installation and testing. |
| network | exceeds purpose | Package metadata declares network: none. External links appear only in documentation; no network code was observed. |
| install_packages | exceeds purpose | README instructs npm install -g . and package.json includes npm link scripts, but automatic package installation behavior was not observed in the reviewed files. |
| other | exceeds purpose | The declared ./filesystem executable is not present in the reviewed package, preventing full behavioral verification. |
| severity | finding |
|---|---|
| medium | Declared executable file not included in review package.json points the command name filesystem to ./filesystem, but no file named filesystem was present among the package files reviewed, so its actual behavior cannot be verified. package.json:7 "filesystem": "./filesystem" |
| medium | Skill requests read-write filesystem access The metadata declares read-write filesystem permission. This permits reading local files and writing or copying them, which is broader than read-only and requires user review. package.json:57 "filesystem": "read-write", |
| info | Network permission denied in metadata The package declares no network permission. External links appear only in documentation and are not observed network calls from code. package.json:59 "network": "none", |
| info | Requires Node.js runtime The skill declares Node.js as a runtime requirement. Any CLI execution would rely on node being available. package.json:54 "bins": ["node"] |
| info | Configured operations are limited The configuration restricts allowed operations to read, copy, and analyze. Destructive operations such as delete or arbitrary write are not listed. config.json:31 "allowedOperations": ["read", "copy", "analyze"], |
| info | Protected system paths configured The configuration includes protected paths such as /etc, with additional entries for /var/lib, /usr/bin, /system, C:\Windows, and C:\Program Files. config.json:33 "/etc", |
| medium | Publisher discloses broad read-write risk The skill card acknowledges that broad local filesystem access and search/copy behavior can touch private or unintended directories. skill-card.md:25 Risk: The skill requests broad read-write local filesystem access, including search and copy behavior that can touch private or unintended directories. |
| low | Manual install instructs cloning remote repository The README instructs users to clone from GitHub. This fetches external code before installation. README.md:47 git clone https://github.com/gtrusler/clawdbot-filesystem.git |
| low | Manual install instructs global npm install The README instructs global npm installation, which can place a command on PATH and execute package scripts. README.md:54 npm install -g . |
| info | Test example writes a file The README testing example uses shell redirection to create test.txt. This is a manual test command, not observed package code. README.md:241 echo "TODO: Test this function" > test.txt |
| low | Debug command executes a node one-liner The README troubleshooting section shows a node -e command to read config.json. It is an instruction, not observed automatic execution. README.md:275 node -e "console.log(require('./config.json').performance)" |
| low | Promotional external social link The documentation promotes following an X account. This is external promotion; no code in the reviewed files performs network access. README.md:309 - 🐦 **Follow [@LexpertAI](https://x.com/LexpertAI)** on X for skill updates and releases |
0 AI finding(s) were dropped because their file, line or quote did not match the package.
| domain | service rating | where |
|---|---|---|
| clawdhub.com | not in the service index | README.md:5 |
| clawhub.ai | not in the service index | skill-card.md:9 |
| docs.clawd.bot | not in the service index | README.md:303 |
| github.com | not in the service index | README.md:47 |
| img.shields.io | not in the service index | README.md:5 |
| nodejs.org | not in the service index | README.md:7 |
| x.com | not in the service index | README.md:309 |
| Binaries invoked | bash, chmod, git, node, npm |
| Environment variables read | none |
| Hard-coded wallets | none |
| Pipes a download to a shell | 0 |
| eval / exec / subprocess | 0 |
| base64 blobs | 0 |
| File writes | 0 |
| Persistence | 0 |
| file | lines | sha256 |
|---|---|---|
LICENSE.md | 21 | ecab1e261aab2aa4… |
README.md | 322 | bd14e682785513a8… |
SKILL.md | 208 | c36367f5492e8eec… |
_meta.json | 6 | 885194202e4f71b7… |
config.json | 41 | cd666d38f84b12ce… |
package.json | 69 | ef41ecff5b1c1539… |
skill-card.md | 50 | 445c6f123fd16e85… |
For agents
JSON: https://agenteconomy.report/k/clawdbot-filesystem.audit.json · badge: https://agenteconomy.report/k/clawdbot-filesystem.audited.svg ·
skill rating: /k/clawdbot-filesystem · commission an audit of any skill: US$ 29 per version.
The complete published package of this exact version was downloaded from the registry and read statically; nothing was executed. A deterministic pass extracts network destinations, binaries, environment variables, writes, install commands, obfuscation markers, subprocesses and wallets, each with file and line. An AI then reads the whole package with those facts and writes the summary, the capabilities and the findings under a strict schema; every finding it produces must cite a file, a line and the exact text, or it is dropped. The final verdict is the worst of the two passes. The audit does not change the skill's trust tier (policy); the author may respond through the dispute channel and the response is published here. Commissioned by: the Agent Economy Report (free program: the 150 most downloaded skills, September 2026).