Back to skill
Skillv1.2.0
ClawScan security
Structs Power · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 30, 2026, 3:12 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions match its stated purpose (managing Structs power) but the package metadata omits required runtime dependencies (structsd CLI and local key access) and there's minor metadata inconsistency, so proceed with caution.
- Guidance
- This skill appears to do what it says (manage substations/allocations via the structsd CLI), but it assumes the structsd binary and access to local signing keys (the TX_FLAGS --from value). The registry metadata does not declare these dependencies and there is no homepage/source to verify the author. Before installing or enabling autonomous use: (1) confirm you trust the skill owner and the source; (2) ensure structsd is installed intentionally and understand which local key the agent would use to sign transactions; (3) avoid giving the agent access to high-value keys—test in a sandbox or with a low-privilege key; (4) consider disabling autonomous invocation if you do not want the agent to submit transactions without manual approval. Also note a minor metadata mismatch: _meta.json shows version 1.0.1 while registry metadata lists 1.2.0 and there is no homepage—these reduce provenance confidence.
Review Dimensions
- Purpose & Capability
- noteThe SKILL.md actions (creating substations/allocations, connecting players, queries) align with the skill name and description. This is a coherent set of capabilities for a 'power management' skill for Structs.
- Instruction Scope
- noteAll runtime instructions are concrete structsd CLI commands and queries; they stay within the stated domain (power/substations/allocations). However the instructions require submitting transactions (TX_FLAGS) with a '--from [key-name]' which implies the agent will need access to a local keyring or wallet configuration—this is not declared in the metadata.
- Install Mechanism
- noteThe skill is instruction-only (no install spec), which is the lowest install risk. That said, it implicitly depends on the 'structsd' CLI being present on the host; the package metadata lists no required binaries, which is inconsistent with the instructions.
- Credentials
- concernrequires.env lists none, but TX_FLAGS include '--from [key-name]' and the commands will use whatever keyring/config 'structsd' has access to. The skill may cause the agent to read local wallet keys or sign transactions. The lack of declared binary or credential requirements is a proportionality/visibility concern.
- Persistence & Privilege
- okalways:false and no install/write operations. The skill does not request persistent presence or system-level configuration changes in its files. The main risk is transactional (it will instruct the agent to submit on-chain txs if executed).