Back to skill
Skillv0.0.1
ClawScan security
Nimble · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 5:02 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions, scope, and requirements are consistent with a Nimble scooter integration guide; it is an instruction-only skill and does not request unrelated credentials or install artifacts, though it assumes device/adapter access that the platform must provide.
- Guidance
- This skill is an instruction-only Nimble scooter integration guide and appears internally consistent. Before installing, confirm your agent/runtime has the necessary Bluetooth/hardware access and user consent to pair and configure devices. Be aware commands like factory reset or firmware operations can modify or erase device settings — only run them when you intend to. Because the skill is instruction-only it does not itself exfiltrate credentials, but the platform that executes these instructions will need permission to access local devices; review that platform's device-access permissions and logging policies before enabling autonomous invocation.
Review Dimensions
- Purpose & Capability
- noteName and description match the SKILL.md content (connecting, diagnosing, configuring Nimble scooters). The skill describes Bluetooth-based interactions but declares no required binaries or platform capabilities — this is plausible for an instruction-only skill but it implicitly depends on the agent/runtime having Bluetooth access.
- Instruction Scope
- okRuntime instructions are limited to connecting, querying, configuring, diagnosing, and resetting devices. The SKILL.md does not instruct the agent to read unrelated files, exfiltrate data, contact unexpected endpoints, or access unrelated credentials.
- Install Mechanism
- okNo install spec and no code files — lowest-risk form. Nothing is downloaded or written to disk by the skill itself.
- Credentials
- noteThe skill requires no environment variables or credentials, which is appropriate for a local-device instruction guide. It implicitly needs access to local Bluetooth/hardware capabilities and possibly permissions to pair/configure devices; those are not declared here and are provided by the host platform.
- Persistence & Privilege
- okalways is false and the skill does not request elevated or persistent privileges nor instruct modifications to other skills or system-wide configurations.