Back to skill
Skillv1.0.0
ClawScan security
CTF Writeup Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 10, 2026, 4:45 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements, instructions, and scope are coherent with its stated purpose of generating CTF writeups; it requests no credentials, has no install steps, and contains only instructions relevant to producing formatted markdown writeups.
- Guidance
- This skill appears coherent and does what it says: create professionally formatted CTF writeups from user-provided notes. Before installing, consider: (1) CTF writeups commonly include exploit commands and privilege-escalation steps — treat this as dual-use content and avoid pasting real production credentials or sensitive target data into the skill. (2) The skill will save markdown files to the agent workspace; ensure you are comfortable with outputs being written to disk. (3) The skill can be invoked by the model (disableModelInvocation not set) — if you require explicit user approval for every run, request disableModelInvocation or restrict the skill. (4) The SKILL.md references other skills (e.g., ghidra-skill); confirm those integrations are trustworthy before allowing cross-skill access. If you want tighter safety, restrict the agent from including real-world host/IPs or secrets in inputs and require user confirmation before saving or publishing writeups.
Review Dimensions
- Purpose & Capability
- okName/description match the SKILL.md instructions: the skill generates CTF writeups, detects flags, categorizes challenges, formats markdown, and suggests platform-specific templates. No unrelated credentials, binaries, or config paths are requested.
- Instruction Scope
- noteInstructions remain within the writeup generation domain (gather challenge metadata, parse user notes, validate flag formats, produce/safe a markdown file). One notable point: the instructions produce exploit steps, commands, and privilege-escalation descriptions — this is consistent with CTF writeups but is dual-use content (allowed by purpose). The skill also saves files to disk (writes markdown files), which is expected but worth noting.
- Install Mechanism
- okNo install spec or code is included (instruction-only). No downloads or archive extraction occur.
- Credentials
- okRequires no environment variables, credentials, or config paths. The declared and actual surface area match.
- Persistence & Privilege
- noteThe skill does not set always:true. It also does not set disableModelInvocation:true, so the agent could invoke it autonomously when eligible — this is common for utility skills but worth awareness if you want strict user-trigger-only behavior.