Back to skill
Skillv1.0.0
ClawScan security
Log Sift · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 14, 2026, 3:48 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (a simple local log-filtering CLI); it reads only files/stdin and has no network, credential, or install requirements.
- Guidance
- This appears to be a straightforward, local log-filtering script. Before installing: (1) verify you trust the source (the package has no homepage and an unknown owner), (2) ensure you install the script intentionally (rename/move tool.py or create a wrapper so the documented 'log_sift' command works), and (3) run it on non-sensitive files first—the tool will read any file you point it at, but it contains no network or credential usage. The listed price ($2.50) is not implemented in the files; confirm payment/installation details with the publisher if you expect to purchase support or binaries.
Review Dimensions
- Purpose & Capability
- noteName/description ('Log Sift' filter logs) aligns with the included code (tool.py) which implements keyword and date-range filtering. Minor inconsistency: SKILL.md shows a command named 'log_sift' while the included file is tool.py with a shebang—there's no install wrapper provided, so the user must install or rename the script to match the documented command. The SKILL.md also shows a price ($2.50) but provides no purchase/install mechanism.
- Instruction Scope
- okSKILL.md instructs running the CLI against a log file or stdin; the tool's runtime behavior matches that scope. The instructions do not ask the agent to read unrelated system files, environment variables, or contact external endpoints.
- Install Mechanism
- okThere is no install spec (instruction-only + included script). This minimizes risk; the repository provides a simple Python script with a shebang that can be run directly. No downloads or third-party package installs are requested.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths, and the code does not access any secrets or environment variables. It only reads the user-specified file or stdin.
- Persistence & Privilege
- okalways is false and the skill does not request persistent or elevated presence. There is no code that modifies other skills or system-wide configuration.