Back to skill
Skillv1.0.0
ClawScan security
anime-calendar · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 8, 2026, 6:51 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions, required resources, and requested access are coherent with a weekly anime-update/calendar function; it only uses web search/extraction of public sites and requests no credentials or installs.
- Guidance
- This skill appears to do what it says: search public anime sites and extract schedule info. Before installing, consider: (1) metadata mismatch — the ownerId in _meta.json differs from the provided registry ownerId; verify the publisher if provenance is important. (2) The skill uses web-search and scraping tools that will fetch public pages (including platform-specific pages that sometimes require login or have rate limits); confirm your agent's web-extraction tooling is allowed to access those sites and won't expose any private data. (3) No credentials are requested, but if you or the agent supply platform logins separately later (e.g., to view subscriber-only pages), be cautious about granting those credentials. (4) Be aware of copyright and terms-of-service for scraped sites and possible rate-limiting; monitor behavior on first use.
Review Dimensions
- Purpose & Capability
- noteName/description (anime weekly calendar) match the runtime instructions (use web search and website extraction against bilibili, bgm.tv, dmzj.com). However, the _meta.json ownerId differs from the registry ownerId in the provided metadata, which is an inconsistency in packaging/metadata (likely a minor integrity/authoring issue, not functionality-related).
- Instruction Scope
- okSKILL.md confines the agent to using batch_web_search and extract_content_from_websites to fetch public anime schedules and produce formatted weekly calendars. It does not instruct reading local files, environment variables, or sending data to unrelated external endpoints.
- Install Mechanism
- okNo install spec and no code files — instruction-only skill. Nothing will be written to disk by an installer as part of the skill package.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The skill's data needs (public web scraping/search) are consistent with this minimal requirement.
- Persistence & Privilege
- okalways is false and agent invocation is normal. The skill does not request elevated or persistent system-wide privileges.