Back to skill
Skillv1.0.0
ClawScan security
Astro Project Analyzer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 30, 2026, 2:46 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only analyzer that reads an Astro project's local files to produce audits; it asks for no credentials, installs nothing, and its actions align with the stated purpose.
- Guidance
- This is an instruction-only analyzer that will read files in your project directory (astro.config.mjs/ts, package.json, and files under src/content/ etc.) to produce an audit. It does not request credentials, install software, or send data externally in the instructions provided. Before using it: (1) ensure the agent runs with its working directory set to the project you want audited (otherwise it could read other files accessible to the agent); (2) be aware the instructions use common shell utilities and python3 even though no binaries are declared — make sure those are available in the runtime environment; (3) confirm your repository doesn't contain secrets in source files you don't want an analyzer to read (the skill does not explicitly read .env files, but it will read any files in the project tree if asked); and (4) if you allow autonomous invocation, remember the agent may run these local file reads without additional prompts. Overall this skill appears coherent and proportional to its stated purpose.
Review Dimensions
- Purpose & Capability
- noteThe name/description match the instructions: the SKILL.md tells the agent to inspect astro.config.*, package.json and project files under src to audit configuration, performance, SEO, accessibility, content collections, and deployment readiness. One minor inconsistency: the instructions invoke shell utilities and python3 but the skill declares no required binaries — this is an operational mismatch (the analyzer implicitly requires a shell environment and Python) but not a security concern.
- Instruction Scope
- okInstructions are focused on scanning project files (astro.config.mjs/ts, package.json, files under src, content collections) and producing a report. They do not instruct the agent to read unrelated system files, environment secrets, or to send data to external endpoints. The actions are within the stated scope of auditing an Astro project.
- Install Mechanism
- okThere is no install spec and no code files — the skill is instruction-only, so nothing is downloaded or written to disk by the skill itself.
- Credentials
- okThe skill declares no required environment variables or credentials and the runtime instructions do not access secrets or external credentials. It does mention verifying environment variables as part of deployment readiness (as a reporting item), but does not request or read them automatically.
- Persistence & Privilege
- okThe skill does not request persistent/always-on privileges (always: false). Autonomous invocation is allowed by default but is not combined with broad credential access or other elevated privileges.