https://clawhub.ai/api/v1/skills/async-command/file?path=SKILL.md&version=1.2.1
github.com/clawhub.ai/async-command
Scanned Thu, 28 May 2026 16:43:27 GMT
Scan ID crawl-r9kmxaibasafk6eestk7vl6t · 0ms
C
SCORE 55 / 100
Verdict: Proceed with caution

8 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 7 other issues listed below.

0 critical0 high8 medium4 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 8 medium findings (6+ MEDs → C).

0 CRIT0 HIGH8 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 3 of 8 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 6 of 8 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 32CWE-78
▾
30```python
31# 1. Start in background, yield to not block
32exec(command="...", yieldMs=30000)← spawns a subprocess outside declared capabilities
33
34# 2. While waiting, do other things
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 45CWE-78
▾
43**Step 1: Start without blocking**
44```python
45exec(command="your command here", yieldMs=60000)← spawns a subprocess outside declared capabilities
46```
47`yieldMs` = how long to wait before backgrounding. Longer = more output captured.
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 71CWE-78
▾
69```
70# ❌ What most people do
71exec(command="make build", timeout=300)← spawns a subprocess outside declared capabilities
72# Waits 5 minutes, then fails anyway
73
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 75CWE-78
▾
73
74# ✅ Async approach
75exec(command="make build", yieldMs=10000)← spawns a subprocess outside declared capabilities
76# Starts building, returns immediately, you decide when to check
77```
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 82CWE-78
▾
80```
81# ❌ Re-running to "check"
82exec(command="make build", yieldMs=60000)← spawns a subprocess outside declared capabilities
83# ...then running it again with exec!
84# This starts a SECOND build, wastes resources
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 93CWE-78
▾
91```
92# Start something, then forget about it
93exec(command="python train_model.py", yieldMs=10000)← spawns a subprocess outside declared capabilities
94# (goes on with other work, never checks back)
95
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 97CWE-78
▾
95
96# ✅ Track it, check back periodically
97exec(command="python train_model.py", yieldMs=10000)← spawns a subprocess outside declared capabilities
98# ...later:
99process(action="poll", sessionId="<session_id>", timeout=60000)
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-r9kmxaibasafk6eestk7vl6t