Skillv2.0.3

ClawScan security

Skill Vettr · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignFeb 15, 2026, 12:29 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill is a coherent static-vetting tool that requests only the binaries and actions needed for AST-based analysis; it exposes normal npm-install and temporary-file risks which are documented in its SKILL.md.
Guidance: This skill is internally consistent with its stated purpose (static vetting) but carries the normal risks of Node-based analysis tools: npm install can run lifecycle scripts and tree-sitter packages require native/WASM builds. Before installing or running: 1) Run npm install inside an isolated environment (container/VM) or review the package-lock.json and package.json first. 2) Inspect package.json scripts for postinstall/preinstall entries (the test fixture even includes a malicious example). 3) Verify the required external binaries (git, curl, tar, clawhub) are trusted on your PATH before using vet-url or vet-clawhub. 4) Do not enable allowCwd globally unless you run the scanner from a scoped project directory. 5) If you enable autoVet (skill:pre-install hook), be aware it will run automatically on pre-install events — review configuration and allowed roots carefully. Finally, manual review or sandboxed execution is recommended for high-risk or untrusted sources.
Findings: [prompt-injection:ignore-previous-instructions] expected: A prompt-injection pattern was detected in SKILL.md. Given this skill's purpose (detecting prompt injection), including example patterns in documentation/tests is plausible and expected. Still, presence of such tokens could be used to attempt to influence automated evaluators — treat it as documentation/test material but verify manually if you have doubts.

Review Dimensions

Purpose & Capability: okName/description match code and instructions: this is a JS/TS static analyzer that uses tree-sitter, inspects SKILL.md/package.json, and optionally fetches remote archives via git/curl/tar/clawhub. Required binaries (node, git, curl, tar, clawhub) and the presence of tree-sitter .wasm artifacts are consistent with the stated purpose.
Instruction Scope: noteSKILL.md instructs users to run npm install and documents vet-url/vet-clawhub behavior. The instructions explicitly warn about npm lifecycle scripts, the need for .wasm files, and the filesystem roots the scanner will accept. The skill accepts paths under configurable roots and can be configured to allow process.cwd(), which is documented as a security trade-off (enable only from a scoped directory). Overall the runtime instructions stay within vetting scope, but they do require executing external helper binaries and installing native/WASM artifacts — both of which increase the attack surface and are called out in the docs.
Install Mechanism: noteThere is no registry-level install spec, but SKILL.md and package.json expect running 'npm install'. This is appropriate for a Node-based AST tool that needs tree-sitter WASM/native builds. npm install (and tree-sitter install scripts) can execute lifecycle scripts — the skill documents this and recommends installing inside a container or using --ignore-scripts (which may break functionality). This is a legitimate but non-trivial install risk that the skill itself documents.
Credentials: okThe skill requests no environment variables or credentials. Its runtime code reads files within vetted roots and uses ctx.tools for filesystem ops (mkdtemp, readFile, rm). Those capabilities are necessary to download/extract and scan skill archives. The SKILL.md warns about enabling allowCwd (which expands reachable paths) and about trusting external binaries; those warnings align with the permissions requested.
Persistence & Privilege: okalways:false and normal model invocation are used. The skill can optionally register an autoVet hook (skill:pre-install) if configured; this gives it broader reach to veto installs but is a documented, configurable feature. The skill does not request to persist or modify other skills' settings beyond registering normal hooks/commands.