Skillv1.0.0

ClawScan security

Bytesagain Storefront Page Kit · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 26, 2026, 3:05 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally consistent: it generates ecommerce copy via a local shell script, requests no credentials or installs, and its behavior matches the description.
Guidance: This skill appears coherent and low-risk: it generates storefront and SEO copy locally via a bundled bash script and does not ask for credentials or perform network I/O. Before installing or running, you may want to: (1) quickly inspect scripts/script.sh yourself to confirm there are no unexpected network calls or destructive commands (the provided script is benign), (2) run it in a sandbox or non-production environment if you’re cautious, and (3) verify the copy it produces for accuracy and marketplace compliance before publishing. If you need autonomous agent behavior to be restricted, review platform settings for skill invocation and permissions.

Purpose & Capability: okThe name/description promise (generate product pages, SEO, FAQ, audits) is fulfilled by a bundled bash script that formats copy from product facts. There are no unrelated environment variables, binaries, or config paths requested.
Instruction Scope: okSKILL.md instructs the agent to run the included scripts/script.sh with command-line options; the script only reads its arguments, formats text, and prints output. It does not read system files, access other credentials, or send data to external endpoints.
Install Mechanism: okThere is no install spec and no downloads. The skill is instruction-only with a single included shell script. Nothing is written to disk beyond the existing code bundle.
Credentials: okThe skill declares no required environment variables or credentials and the script does not reference external secrets. The requested surface is minimal and proportionate to producing copy templates.
Persistence & Privilege: okalways is false and the skill is user-invocable. Model invocation is allowed (default), which is normal; the skill does not request permanent presence or modify other skills or system-wide settings.