Back to skill
Skillv3.0.1
ClawScan security
Password · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 19, 2026, 9:54 AM
- Verdict
- Benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's files and instructions match a local password utility: generation, strength/entropy analysis, batch generation, diceware, PINs, and a k‑anonymity breach check; nothing in the provided code indicates covert exfiltration or unrelated privileges.
- Guidance
- This skill appears to be a local password utility and is internally consistent with that purpose. Before installing or using it: (1) inspect the remainder of scripts/script.sh (the provided content was truncated) to ensure it does not log or transmit generated or provided passwords to unexpected endpoints; (2) be aware it will create ~/.local/share/password-tool — check that it doesn't store plaintext secrets you don't want kept; (3) ensure openssl and common CLI tools (od, awk, sort, grep) are available on your system (SKILL.md only mentions curl); (4) breach checking uses Have I Been Pwned with k‑anonymity (only the first 5 chars of the SHA‑1 hash should be sent) — if you want to avoid any network calls, avoid the check-leak command. If you want higher assurance, run the script in a contained environment (VM/container) and review the full script source prior to use.
Review Dimensions
- Purpose & Capability
- okThe name/description match the included scripts: the tool generates passwords, measures strength/entropy, and checks breaches. Requested tools (curl) and use of /dev/urandom, openssl, and common shell utilities are consistent with these functions.
- Instruction Scope
- noteSKILL.md instructs the agent to run scripts/script.sh for all commands, which is expected. The script performs local computation and an optional network call to Have I Been Pwned using k‑anonymity, which is appropriate for breach checking. Two minor scope notes: SKILL.md lists only 'curl' as a requirement but the script uses openssl and other common CLI utilities (od, awk, grep, sort) which are not declared; the script creates a data directory (~/.local/share/password-tool) — the manifest doesn't explain what (if anything) is persisted there. Review the remaining (truncated) part of the script to confirm it doesn't write sensitive data unencrypted or transmit it to unexpected endpoints.
- Install Mechanism
- okNo install spec (instruction-only with a bundled script) — nothing is downloaded from external URLs during install. This is low-risk compared to remote downloads.
- Credentials
- noteThe skill requests no environment credentials (none declared). It does access $HOME and creates ~/.local/share/password-tool to store data; this is plausible for a local tool but users should confirm what is stored. Network access (curl to api.pwnedpasswords.com) is limited to the breach-check feature and uses k‑anonymity; this aligns with the stated purpose.
- Persistence & Privilege
- okalways is false and the skill is user-invocable only. It does not request broad platform privileges or modify other skills. Creating a per-user data directory is normal for a CLI utility, but review what it stores.