Back to skill
Skillv0.1.0
ClawScan security
Inspirai Project · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 3:52 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and runtime instructions align with its stated purpose (creating and managing Discord Threads for project workflows) and request only the Discord configuration stored in user config files—nothing appears disproportionate or covert.
- Guidance
- This skill appears coherent for managing projects via Discord threads, but review these points before installing: - Confirm you trust the source (homepage points to a GitHub repo but source is marked 'unknown'). Review the repository yourself if possible. - The skill reads Discord Bot tokens and channel mappings from ~/.openclaw/openclaw.json or ~/.claude/project-skill.json; those files contain sensitive credentials. If you install, ensure the bot token present is for a bot with only the permissions it needs (Manage Threads/Create Public Threads, Send Messages) and not an overly-privileged account. - The workflow will create threads and post messages to your Discord server; test in a safe/test server first to avoid accidental spam or excessive notifications. - The skill records project metadata to ~/.claude/projects.json (append). Back up or inspect that file format if you have existing project data. - If you want stricter control, consider creating a dedicated bot token scoped to only the target guild/channels and inspect the helper script (discord-threads.py) to confirm behavior before enabling autonomous invocation. If you want, I can summarize exactly which keys/paths the script reads and where it posts to, or point out lines in the code to review for token handling and file writes.
Review Dimensions
- Purpose & Capability
- okName/description (multi-agent project management via Discord threads) match the included instructions and the helper script, which calls Discord APIs to create threads, post messages, and read latest messages. The required artifacts (Discord bot token, channel bindings) are exactly what such a skill needs.
- Instruction Scope
- noteInstructions and helper script read local configuration files (~/.openclaw/openclaw.json and optionally ~/.claude/project-skill.json) and may write/append project metadata to ~/.claude/projects.json as part of bookkeeping. Reading and writing these files is within the skill's stated purpose, but users should be aware the skill will access/modify files under the user's home directory that contain Discord tokens and project data.
- Install Mechanism
- okNo install spec; the skill is instruction-driven with one helper Python script. Nothing is downloaded or written during install by the package itself.
- Credentials
- noteThe skill does not request environment variables but reads bot tokens and channel mappings from local config files (~/.openclaw/openclaw.json or ~/.claude/project-skill.json). That is proportional to a Discord-integrated skill, but these files contain sensitive Bot tokens—users should ensure only the intended token is present and that the token has minimal required permissions.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated platform privileges. It does persist project records to ~/.claude/projects.json per its documentation (bookkeeping), which is within scope and limited to the skill's own data.