Skillv0.2.1

ClawScan security

CLI Agent Bridge for OpenClaw · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 11, 2026, 7:43 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This package is a documentation-only public release describing a separate local Windows companion; it contains no executables, install steps, credentials, or filesystem access by itself and is internally consistent with its stated purpose.
Guidance: This release is documentation-only and does not execute or request credentials. If you plan to use the full runnable companion described here, obtain that local package from a trusted source and review any .ps1/.bat executables and install scripts before running them. Confirm the local companion enforces the documented workspace-root and approval gating for writes, and verify any provider CLIs (gemini/claude/codex) are installed and authenticated locally. The absence of code in this upload reduces immediate risk, but the full functionality depends on a separate local package — review that package carefully before use.

Purpose & Capability: okThe name/description claim a Windows companion that bridges local AI CLIs and guarded file ops; the published bundle is documentation-only and explicitly states the runtime PowerShell executors and installers are intentionally excluded, which matches the claimed scope.
Instruction Scope: okSKILL.md and reference files are descriptive documentation; they do not instruct the agent to run commands, read local files, or transmit secrets at runtime. The files repeatedly state that executable behavior lives in a separate local package.
Install Mechanism: okThere is no install spec and no code files. Nothing will be written or executed on install from this upload-only release, so install risk is minimal and proportionate to the documentation purpose.
Credentials: okNo environment variables, credentials, or config paths are requested. The documentation notes that local providers (gemini/claude/codex) require separately installed CLIs and authentication, which is appropriate and not requested by this text release.
Persistence & Privilege: okalways is false and the package does not request persistent system presence or modify other skills. As a documentation-only skill it does not gain elevated privileges.