Skillv0.1.2

ClawScan security

Hackathon Swarm Coding · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 15, 2026, 1:47 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill appears to do what it claims (autonomous multi-agent code generation with OpenRouter), but it reads and writes files in the parent workspace (including .env), retains decision logs containing prompts/reasoning, and the registry metadata mismatches the runtime requirements — these behaviors raise data-exposure and coherence concerns that you should understand before installing.
Guidance: Before installing or running this skill: - Treat it as requiring an OpenRouter API key (OPENROUTER_API_KEY). The registry listing omitted this — verify the key and its model access. - Run the skill only inside a clean, isolated workspace directory (no other .env or secret files there). The orchestrator reads .env from the workspace root and will throw if missing; if your workspace .env contains other secrets, they could be read by the skill. - Use MOCK=1 for a dry run to see behavior without API calls. - Expect generated code and logs (swarm-projects/, DECISIONS.md, .learnings/) to contain your prompts and agent reasoning; review and remove sensitive content before sharing or committing to VCS. - Pay special attention to any blockchain/Privy integration the skill auto-includes — review auth-related code and never paste real private keys or secrets into prompts. - If you want to reduce risk, run the skill inside a disposable container/VM or dedicated OS user directory, and ensure .env contains only the OpenRouter key you intend to share. Remove or rotate the key after testing if appropriate. - Ask the publisher to fix the metadata inconsistency (declare required env vars in the registry) and to document exactly what the orchestrator reads from .env.

Review Dimensions

Purpose & Capability: noteThe skill's functionality (orchestrating an LLM to scaffold projects) legitimately requires an OpenRouter API key and filesystem access to write generated projects. However, the registry metadata provided to the platform lists no required env vars while SKILL.md and orchestrator.js both require OPENROUTER_API_KEY — an inconsistency that should be corrected/clarified.
Instruction Scope: concernSKILL.md and orchestrator.js instruct the agent to read a .env file from the workspace root (parent directory of the skill) and to write project files and persistent logs (swarm-projects/, DECISIONS.md, .learnings/). DECISIONS.md and .learnings/ capture prompts and agent reasoning. Reading the parent .env and persisting detailed logs increases the risk of accidental disclosure of unrelated secrets or sensitive prompt content.
Install Mechanism: okThere is no external install spec (instruction-only plus a single orchestrator.js). Nothing is downloaded from arbitrary URLs and no installer writes to unexpected system locations. This is the lower-risk install pattern.
Credentials: concernRequesting OPENROUTER_API_KEY is proportionate to the stated purpose. However, the orchestrator reads the entire .env at the workspace root (not just the declared variable), meaning any other credentials colocated in that .env are accessible by the skill. The registry metadata failing to declare the required env var is another proportionality/consistency issue. The automatic inclusion of Privy/web3 scaffolding when prompts mention blockchain is a functional choice but can lead to generation of auth-related code that requires review.
Persistence & Privilege: concernThe skill persists project files and an ongoing learning log (.learnings/, DECISIONS.md) across runs and records prompts/agent reasoning. While 'always' is false, the retained logs create a persistent record on disk that may contain sensitive inputs. The skill does not modify other skills or system configs, but its local persistence and read access to workspace .env are notable privileges.