Back to skill
Skillv1.0.0
ClawScan security
DoctorClaw Social Drafter · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 27, 2026, 10:47 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only social media drafting helper and its declared requirements and instructions are coherent with that purpose — nothing requested or installed appears disproportionate or unexpected.
- Guidance
- This skill is instruction-only and appears coherent with its stated purpose. Before using: (1) Only provide URLs, brand docs, or post history you are comfortable sharing — the agent may fetch/parse those when asked. (2) If you connect a posting tool (Buffer/Hootsuite or direct APIs), supply credentials only when you trust the environment and consider using per-app tokens with limited scope. (3) Review generated drafts before scheduling or publishing (for privacy, accuracy, and brand/legal compliance). (4) If you enable optional engagement monitoring or trend surfing later, expect those features to require additional access and continuous monitoring — confirm what data and scopes are requested.
Review Dimensions
- Purpose & Capability
- okName and description (social media drafter) match the SKILL.md content. There are no required binaries, env vars, or installs that are unrelated to drafting and optional scheduling; requested optional integrations (Buffer/Hootsuite/direct API) are reasonable for a post-scheduling workflow and are listed as optional.
- Instruction Scope
- noteThe runtime instructions stay focused on generating platform-specific drafts and variations. They mention extracting key points from user-provided URLs and optionally scheduling posts or logging to a content calendar; these imply network access or file access if the user opts in, but the skill does not instruct the agent to read unrelated system files or to exfiltrate data. The instructions are somewhat high-level about integrations (e.g., 'schedule the approved posts') and assume the user will provide any credentials or posting tools.
- Install Mechanism
- okNo install spec and no code files — instruction-only, so nothing will be written to disk or fetched during install. This is the lowest-risk install profile.
- Credentials
- okNo required environment variables, credentials, or config paths are declared. Optional features would require credentials if used (posting APIs, Buffer/Hootsuite), but these are not required by the skill and are proportional to the optional functionality.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. It does not request persistent presence or to modify other skills or system settings. Autonomous invocation is allowed by default but there are no other privilege escalations requested.