Skillv1.0.0

ClawScan security

Sirket Kurulus Temel · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 28, 2026, 8:15 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only guidance skill about post‑incorporation steps for Turkish companies; its files, declared requirements, and instructions are consistent with that purpose and do not request credentials, install anything, or perform unexpected operations.
Guidance: This skill is essentially a bundled set of static reference documents about Turkish company post‑incorporation tasks and appears internally consistent and low risk. Before installing: (1) verify you trust the publisher (owner ID is present but homepage/source are unknown), (2) treat the content as general guidance — confirm legal or tax decisions with a licensed advisor, and (3) note that the skill can be invoked by the agent automatically (platform default), but it does not request credentials, run installs, or access files or networks according to the provided materials.

Purpose & Capability: okThe name and description match the provided materials (checklists and reference documents about Turkish post‑incorporation procedures). The skill requires no binaries, env vars, or installs — appropriate for a documentation/assistant skill.
Instruction Scope: okSKILL.md and the three reference files are static guidance documents. They instruct the agent to present checklists and explain legal/administrative steps; they do not instruct the agent to read local files, access environment variables, call external endpoints, or collect/transmit user data.
Install Mechanism: okNo install spec and no code files; nothing will be written to disk or downloaded during install. This is the lowest‑risk class (instruction-only).
Credentials: okThe skill declares no required environment variables, credentials, or config paths. There are no unrelated secrets requested — proportional to a documentation/help skill.
Persistence & Privilege: okalways:false (default) and autonomous invocation allowed (platform default). The skill does not request persistent system presence or modify other skills/configuration.