Skip to content

v6.3.0 - SkillSpector audit findings fix

Choose a tag to compare

@EdwardWason EdwardWason released this 20 Jul 10:03

v6.3.0 - ClawHub SkillSpector Audit Findings Fix

Fixed

  • Finding 1 (Purpose & Capability concern): description said "Do NOT use for editing existing skills" but R5 route explicitly supports improving existing skills. Removed "editing existing skills" from Do NOT, added R5 disclosure in description and optional capability declaration.
  • Finding 2 (Instruction Scope concern): composition-and-pipeline.md referenced explicit SkillHub API URL but permission table said "no network access". Removed API URL literal, replaced with generic "TRAE built-in tools"; updated permission table to "network access: yes (via TRAE built-in tools)".
  • Finding 3 (Persistence & Privilege concern): R5 existing-skill modification path not disclosed in frontmatter boundary. Added explicit disclosure in description and user warning.

Changed

  • Version from 6.2.0 to 6.3.0
  • description: removed "editing existing skills" exclusion, added "improve Skill" capability + optional capability disclosure
  • Permission table: network access from no to yes (TRAE built-in tools for SkillHub search)
  • User warning: added R5 existing-skill modification explanation

Full Changelog: v6.2.0...v6.3.0