https://clawhub.ai/api/v1/skills/session-coordinator/file?path=SKILL.md&version=3.0.1
github.com/clawhub.ai/session-coordinator
Scanned Thu, 28 May 2026 16:43:26 GMT
Scan ID crawl-x75l92p6uv0tp6tjhtjw82oi · 3ms
C
SCORE 55 / 100
Verdict: Proceed with caution

17 medium findings.

This skill spawns subprocesses outside its declared capabilities plus 16 other issues listed below.

0 critical0 high17 medium-5 rules passed

Why grade C?

score · 55 / 100

The current grade reflects 17 medium findings (6+ MEDs → C).

0 CRIT0 HIGH17 MED0 LOW
To reach a higher grade
  • B
    Reach Btarget score 75

    Resolve 12 of 17 MED (cap is 5).

  • A
    Reach Atarget score 95

    Resolve 15 of 17 MED (cap is 2).

Thresholds are documented at /docs/grading. Source-of-truth is the grade() function in @skillox/scanner.

Findings · ordered by severity

med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 55CWE-78
▾
53```python
54# ✅ Default: session thread (most tasks)
55spawn(task="task-description", mode="session", thread=true, label="task-label")← spawns a subprocess outside declared capabilities
56
57# ✅ Explicit one-shot: only when scope is trivially bounded
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 58CWE-78
▾
56
57# ✅ Explicit one-shot: only when scope is trivially bounded
58spawn(task="task-description", mode="one-shot", label="task-label")← spawns a subprocess outside declared capabilities
59
60# ❌ Don't use run unless you explicitly need detached/no-result
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 61CWE-78
▾
59
60# ❌ Don't use run unless you explicitly need detached/no-result
61spawn(task="task-description", mode="run")← spawns a subprocess outside declared capabilities
62```
63
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 78CWE-78
▾
76```python
77# Fast task — 5 min timeout
78spawn(task="check service status", runtime="fast", label="service-status-check")← spawns a subprocess outside declared capabilities
79
80# Medium task — 15 min timeout
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 81CWE-78
▾
79
80# Medium task — 15 min timeout
81spawn(task="clone repository and run tests", runtime="medium", label="repo-test")← spawns a subprocess outside declared capabilities
82
83# Long task — 60 min timeout
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 84CWE-78
▾
82
83# Long task — 60 min timeout
84spawn(task="full deployment pipeline", runtime="long", label="deploy-pipeline")← spawns a subprocess outside declared capabilities
85```
86
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 104CWE-78
▾
102```python
103# ✅ Good: generic, dashes, descriptive
104spawn(task="sync config to remote node", label="config-sync")← spawns a subprocess outside declared capabilities
105spawn(task="run test suite for module", label="test-suite")
106spawn(task="deploy service to environment", label="service-deploy")
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 105CWE-78
▾
103# ✅ Good: generic, dashes, descriptive
104spawn(task="sync config to remote node", label="config-sync")
105spawn(task="run test suite for module", label="test-suite")← spawns a subprocess outside declared capabilities
106spawn(task="deploy service to environment", label="service-deploy")
107
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 106CWE-78
▾
104spawn(task="sync config to remote node", label="config-sync")
105spawn(task="run test suite for module", label="test-suite")
106spawn(task="deploy service to environment", label="service-deploy")← spawns a subprocess outside declared capabilities
107
108# ❌ Bad: spaces, specific names, cryptic
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 109CWE-78
▾
107
108# ❌ Bad: spaces, specific names, cryptic
109spawn(task="...", label="proj1") # too short, no dashes← spawns a subprocess outside declared capabilities
110spawn(task="...", label="192-168-1-1") # specific IP — not allowed
111spawn(task="...", label="johns-task") # specific user name — not allowed
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 110CWE-78
▾
108# ❌ Bad: spaces, specific names, cryptic
109spawn(task="...", label="proj1") # too short, no dashes
110spawn(task="...", label="192-168-1-1") # specific IP — not allowed← spawns a subprocess outside declared capabilities
111spawn(task="...", label="johns-task") # specific user name — not allowed
112spawn(task="...", label="foo-bar-v2") # specific project codename — not allowed
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 111CWE-78
▾
109spawn(task="...", label="proj1") # too short, no dashes
110spawn(task="...", label="192-168-1-1") # specific IP — not allowed
111spawn(task="...", label="johns-task") # specific user name — not allowed← spawns a subprocess outside declared capabilities
112spawn(task="...", label="foo-bar-v2") # specific project codename — not allowed
113```
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 112CWE-78
▾
110spawn(task="...", label="192-168-1-1") # specific IP — not allowed
111spawn(task="...", label="johns-task") # specific user name — not allowed
112spawn(task="...", label="foo-bar-v2") # specific project codename — not allowed← spawns a subprocess outside declared capabilities
113```
114
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 205CWE-78
▾
203```python
204# ❌ Wrong — blocks main process, typing disappears
205exec("ssh remote-host ...")← spawns a subprocess outside declared capabilities
206subprocess.run(...)
207
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 206CWE-78
▾
204# ❌ Wrong — blocks main process, typing disappears
205exec("ssh remote-host ...")
206subprocess.run(...)← spawns a subprocess outside declared capabilities
207
208# ✅ Correct — non-blocking, typing stays active
med
Arbitrary subprocess execution detected
The skill spawns subprocesses. Without a capability manifest declaring this, the skill could execute arbitrary commands.
rule: subprocess-executionline: 209CWE-78
▾
207
208# ✅ Correct — non-blocking, typing stays active
209spawn(task="remote operation description", runtime="medium", mode="session", thread=true, label="remote-task")← spawns a subprocess outside declared capabilities
210```
211
med
No capability manifest declared
The skill ships without a `manifest.yaml` or `capabilities` block in its frontmatter. Without a manifest, the runtime cannot enforce what this skill is permitted to do.
rule: no-manifest
▾
Scan another →Share
skillox.io/r/crawl-x75l92p6uv0tp6tjhtjw82oi