Back to skill
Skillv1.0.0
ClawScan security
Case · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 8:54 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only legal-assistance guide whose requested resources and runtime instructions (as provided) align with its stated purpose and do not ask for extra system access or credentials.
- Guidance
- This appears to be a straightforward legal-advice assistant and is internally coherent, but review the full SKILL.md before installing. Pay attention to any later instructions that might ask you to upload or paste sensitive documents, personally identifying information, or privileged communications — do not share privileged or highly sensitive content unless you intend to. Remember this tool is advisory and cannot replace a licensed attorney; consider consulting counsel for case-critical decisions. If you see any instructions in the SKILL.md that ask the agent to read local files, access system credentials, or call unknown external services, treat that as a red flag and do not install.
- Findings
[none] expected: The static regex scanner had no findings — expected for an instruction-only skill with no code files.
Review Dimensions
- Purpose & Capability
- okThe name and description describe a legal-case advisory assistant and the SKILL.md content is consistent with that purpose (case categorization, evidence, timelines, strategy). The skill declares no binaries, no environment variables, and no install steps — all proportionate to an instruction-only advisory skill.
- Instruction Scope
- okThe provided SKILL.md is advisory and focuses on questions about case type, evidence, timelines, and decision points. It does not (in the visible content) instruct the agent to read arbitrary system files, access credentials, or transmit data to third-party endpoints. Asking a user to describe facts or provide documents is expected for this purpose.
- Install Mechanism
- okNo install specification, no code files, and no archive downloads — the lowest-risk model for a skill. Nothing is written to disk or executed by an installer.
- Credentials
- okThe skill does not request environment variables, credentials, or configuration paths. That matches the skill's advisory scope and is proportionate.
- Persistence & Privilege
- okFlags show always:false and normal model-invocation settings. The skill does not request persistent presence, system modifications, or cross-skill configuration changes.