Back to skill
Skillv1.0.0
ClawScan security
PolaBea · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 17, 2026, 6:05 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it's a self-contained, camera-only FSD simulation with no network calls, no credential or filesystem access, and no install steps, so it matches its description.
- Guidance
- This appears to be a harmless, self-contained driving simulation. Before using, keep in mind: (1) it's a simulation that uses random data and a very high confidence threshold—do not deploy this code on real vehicles or hardware without extensive safety review; (2) there are no network calls or secret accesses in the included files, but if you adapt the code to real sensors or add telemetry, re-check for endpoints and credential use; (3) run the script in an isolated environment if you want to be extra cautious, and review any future modifications for added network, file, or credential usage.
Review Dimensions
- Purpose & Capability
- okName/description (camera-only FSD simulation) align with the provided files: SKILL.md, README, and a single Python simulation script. There are no unexpected binaries, services, or credentials required.
- Instruction Scope
- okSKILL.md instructs running the included Python simulation; the runtime instructions and code operate on simulated frames and do not reference external endpoints, system files, or environment variables beyond normal execution.
- Install Mechanism
- okNo install spec is provided (instruction-only plus an included script). Nothing is downloaded or written by an installer; risk from installation is minimal.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths. The code does not access secrets or external services, so requested privileges are proportionate to the stated purpose.
- Persistence & Privilege
- okThe skill does not request persistent/always-on presence (always: false) and does not modify other skills or system settings. It is user-invocable and does not autonomously alter agent configuration.