ClawScan response

Turn an alert or scan complaint into an evidence-backed disposition, an authorized repair, or a report to the component owner. Run from a ClawHub checkout. This skill grants no deployment, moderation, publication, or communication authority; use the authority supplied with the task and the applicable repository skills.

Intake and delegation

Admin owns intake and the final notification. Delegate substantial investigation through the existing runtime so its main session stays available. Read the active workspace's delegation guidance and discover its actual session tools before choosing parameters. Delegating substantial work is instruction/prompt guidance, shaped by workspace policy and runtime defaults; it is not enforced by the spawn engine. Session creation, tool access, and delivery are runtime behavior.

Pass the alert permalink, firing time/window, environment, query/run links, known job or artifact identity, this skill's path, allowed actions, and required return destination to the worker. Include already-active investigation context to avoid duplicate repairs. Use native child status and completion handling; follow the accepted spawn receipt for result delivery. Do not invent a delegation API, impose a worker cap, add a progress database, or schedule another health job.

Workers return evidence and decisions to the requesting Admin session. Admin reviews the result and posts the notification in its established thread. A worker completion establishes neither deployment nor production acceptance.

If the request is an account-ban appeal, route it to clawhub-ban-appeals. That skill may supply a scanner inaccuracy for the upstream-reporting branch below; it retains ownership of the appeal decision.

Establish what happened