Skillv1.0.0

ClawScan security

Domain Email Forwarding · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 24, 2026, 8:08 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only guide for configuring domain email forwarding (GoDaddy, Cloudflare, Namecheap, ImprovMX) and its requested/installed footprint matches that purpose.
Guidance: This is a straightforward how-to. Before following it, remember: you must log into your registrar/DNS provider (keep those credentials secure); changing MX records can disrupt existing email hosting, so verify current settings first; third-party forwarders (ImprovMX, Cloudflare) will see the forwarded mail — review their privacy/retention policies; verify the destination inbox (follow verification links) to activate forwarding; after completing account recovery, consider removing or tightening forwarding rules to reduce long-term exposure. If you're unsure about current MX/SPF/DMARC settings, take screenshots or back up DNS records before changing them so you can restore the original state.

Purpose & Capability: okName and description match the SKILL.md instructions: this is a how-to for configuring email forwarding across listed providers. Nothing in the skill requests unrelated binaries, credentials, or system access.
Instruction Scope: okInstructions are limited to web-dashboard actions, DNS/MX edits, and a suggested 'dig MX' check. The guide does not instruct the agent to read local files, access unrelated environment variables, or send data to unexpected external endpoints.
Install Mechanism: okNo install spec or code is included (instruction-only). That is appropriate for a documentation-style skill and minimizes filesystem or network install risk.
Credentials: okThe skill declares no required environment variables or credentials. The operations described legitimately require the user to log into their registrar/DNS provider, but the skill itself does not request extra secrets or unrelated service keys.
Persistence & Privilege: okThe skill does not request persistent presence (always:false) and does not instruct modification of other skills or system-wide agent settings.