Back to skill
Skillv1.0.4
ClawScan security
Byt Workflow · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 8, 2026, 9:07 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's stated workflow (YouTube -> local translation app) is plausible, but the instructions assume and reference local scripts, absolute Windows paths, and other skills that are not packaged or declared, which is incoherent and could cause the agent to run arbitrary local code or access files unexpectedly.
- Guidance
- This skill is an instruction-only workflow that expects local scripts and apps on your Windows machine (WSL + python.exe + Doubao + audio player) and references absolute paths on the H: drive. Before installing or running: 1) verify the referenced workflow.py and any other scripts actually exist on the host and inspect their contents (the package does not include them); 2) confirm you trust the source—running this skill will execute local programs and control the GUI, which can read/write files and perform automation; 3) ensure the required tools (WSL, Python, Doubao) are installed deliberately and only grant access to directories you are comfortable exposing; 4) be cautious if you don't want the agent to access your H: drive or control the desktop—do not run this skill until you can review the local scripts it will execute. If you want higher assurance, request a version that includes the workflow script or a clear manifest of external dependencies and their locations.
Review Dimensions
- Purpose & Capability
- concernName/description match the workflow in SKILL.md, but the skill references a local script and absolute Windows paths (/mnt/h/...) and other skills (youtube-audio-download, doubao-launch, audio-play, doubao-capture) that are not included or declared. Required runtime pieces (WSL, python.exe, Doubao, visible Windows desktop) are implicit but not declared. The skill therefore assumes access to local resources beyond what's packaged.
- Instruction Scope
- concernRuntime instructions tell the agent to execute a Windows Python script via WSL and to perform GUI automation (Doubao) and read/write files on H: (e.g., H:/works/...). The skill explicitly relies on local filesystem and GUI automation; because no local scripts are provided, the agent would try to invoke files on the host filesystem, creating risk of executing unexpected code or reading unrelated files.
- Install Mechanism
- okNo install spec and no bundled code files are included, which reduces remote install risk. However, absence of packaged code combined with references to an absolute local entry path means the skill depends on host-side artifacts rather than installing its own components.
- Credentials
- noteThe skill requests no environment variables or credentials, which is consistent with a purely local GUI/file workflow. Still, it implicitly requires tools (WSL, python.exe, Doubao app, audio playback) and access to H: drive files; these environmental requirements are not declared and may grant broad filesystem and GUI access.
- Persistence & Privilege
- okalways is false and there is no indication the skill requests persistent or elevated platform privileges. It does, however, expect to run local executables and GUI automation during invocation.