Back to skill
Skillv2.0.5
ClawScan security
Encrypt · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 24, 2026, 1:15 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This skill is an instruction-only local reference tool (text output via a shell script) and its required resources match the stated purpose; nothing requests secrets or network access.
- Guidance
- This skill is a local reference that only prints documentation from a shell script and does not access the network or secrets. It appears safe and coherent with its description. Before using: (1) note the small version mismatches between the registry, SKILL.md, and the script — verify you have the intended version if that matters; (2) if you run the included shell script on production or restricted hosts, review the script (it only prints text) and run it with least privilege; (3) if you expected a skill that integrates with external services, be aware this one does not require or use any API keys or network access. Overall: fine to install for local reference, but fix/document the version drift and ambiguous quickstart wording for clarity.
Review Dimensions
- Purpose & Capability
- okName/description indicate a local reference for 'Encrypt' concepts; included files (SKILL.md and scripts/script.sh) only emit plain-text documentation. No additional credentials, binaries, or external services are required, which aligns with the stated purpose.
- Instruction Scope
- noteRuntime instructions and the shell script only print documentation (heredocs) and handle CLI args. SKILL.md explicitly states 'No API keys or credentials required' and the script does not perform network calls or read files/env vars. Minor inconsistencies: SKILL.md quickstart mentions 'Required tools and access credentials' (likely generic wording) and there are version mismatches between registry (2.0.5), SKILL.md (2.0.4) and the script VERSION (2.0.3). These are quality issues but not security-critical.
- Install Mechanism
- okNo install specification (instruction-only plus a simple script). Nothing is downloaded or extracted; the risk from installation is minimal.
- Credentials
- okThe skill requests no environment variables, no credentials, and references no config paths. The declared requirements are minimal and proportionate to a documentation/reference tool.
- Persistence & Privilege
- okalways is false and the skill does not request permanent presence or modify system/other-skill configurations. Normal autonomous invocation is allowed by default but not combined with any broad privileges here.