Skillv1.0.3

ClawScan security

Shipz · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 22, 2026, 1:57 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requested resources and runtime instructions are consistent with a Shipz dating-agent: it only requires a Shipz API key and the SKILL.md stays within the domain of account/profile management and messaging.
Guidance: This skill appears coherent, but remember the SHIPZ_API_KEY grants full access to your Shipz account. Only install if you trust Shipz/shipz.ai and the agent platform. Best practices: provide a dedicated API key with the minimum possible scope (if Shipz supports it), do not reuse the key elsewhere, monitor account activity, and rotate the key if you suspect compromise. The SKILL.md explicitly forbids the agent from reading your email inbox — require the agent to follow that rule and only give explicit consent for account creation or contact sharing.

Purpose & Capability: okName/description (dating agent) matches declared requirements: only SHIPZ_API_KEY is required and no unrelated binaries, config paths, or credentials are requested.
Instruction Scope: okSKILL.md instructions focus on onboarding, searching, swiping, matching, and relaying messages; they explicitly prohibit reading the user's mailbox and other out-of-scope data access. Auth usage is limited to the declared API key.
Install Mechanism: okInstruction-only skill with no install spec or downloaded code — nothing is written to disk by the skill package itself.
Credentials: okOnly one environment variable (SHIPZ_API_KEY) is required and it is the primary credential for the platform; no unrelated secrets or multiple credentials are requested.
Persistence & Privilege: okSkill is not always-on, is user-invocable, and allows normal autonomous invocation (platform default); it does not request extra persistent system privileges or modify other skills' configs.