Back to skill
Skillv1.2.0
ClawScan security
Structs Combat · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 30, 2026, 3:12 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions clearly require running the 'structsd' CLI and using locally-stored transaction keys/PoW compute, but the skill metadata declares no required binaries, credentials, or install steps—an inconsistency that could lead to unsafe or surprising behavior if you run it without verifying sources and keys.
- Guidance
- This skill will run transaction commands and PoW compute via the 'structsd' CLI and expects you to use local signing keys. Before installing or running it: 1) Verify the skill's source/homepage and the origin of the 'structsd' binary — do not run untrusted binaries. 2) Expect to use local wallet/keyring entries (the skill uses '--from [key-name]'); never paste private keys into untrusted interfaces. 3) Understand that transactions will be signed/submitted (may spend assets) and PoW compute will use CPU on your machine. 4) Ask the author for missing metadata: required binary ('structsd' name and version), exact key/location requirements, any config paths, and a repository link. 5) If you test, do so in a sandbox or with test keys/accounts first. 6) The _meta.json version mismatch vs registry and the lack of declared dependencies are red flags—proceed only after obtaining clear provenance and verifying the CLI and commands on a safe test environment.
Review Dimensions
- Purpose & Capability
- concernThe SKILL.md is a procedural guide for the 'structsd' CLI (transaction submission, stealth activation, fleet movement, PoW compute). The registry metadata, however, lists no required binaries, no required credentials, and no install steps. A combat/transaction skill would reasonably require the 'structsd' binary and access to signing keys; their absence in the declared requirements is an incoherence.
- Instruction Scope
- concernInstructions instruct the agent (or user) to run transaction-signing commands (e.g., 'structsd tx ... --from [key-name]') that will submit on-chain transactions and to run long-running PoW compute locally. These actions involve signing with local keys, spending assets, and heavy CPU use — all sensitive operations that are not constrained or documented in the metadata.
- Install Mechanism
- noteThere is no install spec (instruction-only), which is lower risk from code supply perspective. However, because the instructions depend on an external CLI ('structsd') that is not declared, the missing install/dependency declaration is a notable omission rather than a benign omission.
- Credentials
- concernThe skill declares no environment variables or primary credentials, but its runtime steps implicitly require access to signing keys (via '--from [key-name]') and potentially local keyrings/config files. It also directs the user to run local PoW compute which consumes CPU. The skill does not declare or justify access to these sensitive local artifacts.
- Persistence & Privilege
- okThe skill is not always-enabled and has no install hooks or config paths declared. It does not request persistent system presence in the metadata. Note: autonomous invocation is allowed by default but this alone is normal for skills.