Back to skill
Skillv1.0.1
ClawScan security
Wealth · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 8:17 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only financial-advice assistant whose files and runtime instructions are coherent with its stated purpose and it does not request extra access or install anything.
- Guidance
- This skill appears internally consistent with being a financial-advice assistant. Before installing: (1) Verify the publisher/author and prefer known sources — registry shows an unknown source while skill.json lists a homepage; (2) Treat outputs as general guidance only — consult licensed financial, tax, or legal professionals for decisions with legal/tax consequences; (3) Avoid entering sensitive identifiers (SSNs, account numbers, login credentials) into prompts — the skill itself doesn't request secrets, but your agent environment may log or transmit inputs; (4) Check your platform's privacy and data-retention rules for conversational data and autonomous invocation behavior. If you need stronger assurances, request a signed author identity or host-verifiable source before deploying.
- Findings
[NO_SCAN_FINDINGS] expected: The static regex scanner found nothing because the skill is instruction-only (no code files). This absence of findings is expected for a prose-only skill, but does not imply safety of downstream model behavior.
Review Dimensions
- Purpose & Capability
- okThe name, description, examples, and capability list all describe personal financial planning, investing, tax optimization, protection, and retirement guidance. There are no declared credentials, binaries, or config paths that would be out of scope for a financial advice skill. (Minor metadata inconsistencies: skill.json lists homepage and author while the registry metadata shows source/homepage unknown; this is a bookkeeping mismatch, not a capability mismatch.)
- Instruction Scope
- okSKILL.md, examples.md, and heartbeat.md contain prompts, checklists, and conversational examples for financial guidance. The instructions do not direct the agent to read system files, access unrelated environment variables, call external endpoints, or transmit data outside a normal conversation flow.
- Install Mechanism
- okThere is no install spec and no code files to install or execute. Being instruction-only makes the install surface minimal and low-risk.
- Credentials
- okThe skill declares no required environment variables, primary credential, or config paths. That is proportionate for a conversational financial-advice skill.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; disable-model-invocation is false (normal). The skill does not request persistent agent-wide changes or special privileges.