Back to skill
Skillv1.0.1
ClawScan security
Steamcommunity · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 12, 2026, 11:50 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and instructions are consistent with its stated purpose (reading Steam inventories and sending trade offers) and it does not ask for unrelated system access — but it requires highly sensitive Steam cookies/session data, which you should only provide if you trust the skill.
- Guidance
- This skill legitimately needs your Steam ID, Web API key, and session cookies to read private inventories and send trade offers — those cookies/sessionid are effectively keys to act as your account on steamcommunity.com. Only provide them if you trust the skill's source. Prefer these precautions: 1) Use an expendable/secondary Steam account (not your main account) when testing. 2) Do not paste long-lived cookies into long-term files or public logs; provide them only in ephemeral environment variables and revoke them afterward (log out or change password to invalidate). 3) Consider limiting the skill to read-only actions (omit STEAM_COOKIES/STEAM_SESSION_ID) if you only need public inventory data. 4) After use, invalidate the session (log out) and rotate your API key if you suspect misuse. 5) If you want more assurance, request a code review or a vendor/source identity before trusting trade-capable automation.
Review Dimensions
- Purpose & Capability
- okName and description match the required assets: the skill needs SteamID, Steam Web API key, and authenticated session cookies to read private inventories and to create trade offers. Required binaries (curl and jq) are appropriate for the curl+jq usage shown.
- Instruction Scope
- okSKILL.md is instruction-only and explicitly shows curl commands against steamcommunity.com using the provided cookies, sessionid, and API key. It does not instruct the agent to read unrelated files or credentials. It does, however, tell the user to extract sensitive cookies from their browser and export them as env vars so the agent can authenticate — this is necessary for the declared trade-offer functionality but expands the agent's power to act on your behalf (e.g., send trades).
- Install Mechanism
- okNo install spec and no code files; lowest-risk install mechanism. The skill relies on existing system binaries (curl, jq) which is consistent with the documented usage.
- Credentials
- okThe required env vars (STEAM_ID, STEAM_API_KEY, STEAM_COOKIES, STEAM_SESSION_ID) are directly relevant to the skill's purpose. They are highly sensitive (cookies and sessionid grant authenticated access) but their presence is justified by the need to access private inventories and send trade offers.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide config or modify other skills. Model invocation is allowed (platform default), which combined with the auth material would permit autonomous actions, but this is expected for usable trade-offer automation.