Back to skill
Skillv9.9.5
ClawScan security
Backlink Analyzer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 4:06 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only backlink analysis helper whose requested resources and actions align with its declared purpose and it does not ask for extraneous credentials or installs.
- Guidance
- This skill appears coherent and low-risk: it’s instruction-only, has no installers, and does not request secrets. Before installing, consider: 1) If you connect external SEO tools, only supply scoped API keys and verify which connector endpoints will be used. 2) The skill will write analysis summaries to agent memory (open-loops/decisions); avoid feeding sensitive or personally identifiable data in uploads if you do not want it stored. 3) Outreach templates are provided but the skill does not itself send emails — confirm your agent/tooling won't autonomously perform outreach without explicit consent. If you want extra assurance, review the CONNECTORS.md (if present) to see how optional integrations behave and which endpoints they call.
Review Dimensions
- Purpose & Capability
- okThe name/description (backlink analysis, toxic links, opportunities) aligns with the SKILL.md content and the included templates. There are no unexpected required binaries, env vars, or installs that would be unrelated to SEO/backlink analysis.
- Instruction Scope
- okInstructions are scoped to collecting backlink data (via optional connectors or user-uploaded CSVs), analysing link quality, identifying toxic links, comparing competitors, and producing reports/templates. The SKILL.md references reading repository documents (CLAUDE.md, state model) and writing standard agent memory files (memory/open-loops.md, memory/decisions.md) which is consistent with producing and tracking analysis. It does not direct the agent to read arbitrary system files, secret env vars, or post data to unexpected external endpoints.
- Install Mechanism
- okNo install spec and no code files — instruction-only — so nothing will be downloaded or written to disk by an installer. This is the lowest-risk installation profile.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. Where external SEO tool connectors are optional, the SKILL.md sensibly asks for connectors or CSV uploads; any API keys would be provided only if the user opts to connect tools. No unrelated credentials are requested.
- Persistence & Privilege
- noteThe skill writes analysis outputs and promotes actions into agent memory files (open-loops/decisions), which is appropriate for a reporting/monitoring skill. always:false (not force-installed) and normal autonomous invocation settings are used. Users should be aware that analyses and recommendations will be saved in the agent's memory files per the skill contract.