Skillv1.0.0

ClawScan security

Release Readiness Checker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 27, 2026, 11:45 PM

Verdict: suspicious
Confidence: high
Model: gpt-5-mini
Summary: The skill's instructions match a release-audit purpose, but the SKILL.md calls many tools and networked CLIs (git, python3, rg, npm, npm audit, gh, etc.) while the metadata declares no required binaries or credentials — that mismatch is incoherent and worth caution.
Guidance: This skill generally does what its name says, but there are important mismatches and practical risks to consider before installing or running it: - Tooling mismatch: SKILL.md expects git, python3, ripgrep (rg), npm (and npm audit), and the GitHub CLI (gh), among others. The registry metadata lists no required binaries — verify these tools are available in the environment where you plan to run the skill. - Credentials and network access: The skill will call networked CLIs (npm audit, gh) that use existing credentials or tokens. The skill metadata declares no required env vars, so ensure you do not expose high-privilege tokens when running this — prefer least-privilege accounts or run in a read-only CI context. - Secret-handling: The checker searches the repo for secret-looking patterns. Review how outputs are displayed or transmitted; do not run this skill in a context where its output could be forwarded outside a trusted environment, and consider running it on a local fork or in a sandbox. - Missing explicit requirements: Ask the skill author (or your registry maintainer) to update metadata to list required binaries and any optional credentials, and to document what network calls the checks perform and where outputs go. If you cannot get that, run the commands manually in a controlled environment instead of invoking the skill autonomously. - Operational advice: Run the checks from a CI job or a developer workstation with only the minimal necessary credentials, and inspect the full SKILL.md (including truncated parts) for any additional network endpoints or commands before use.

Review Dimensions

Purpose & Capability: concernThe skill's name and description (pre-release audit) match the commands in SKILL.md. However, the metadata declares no required binaries or credentials even though the instructions call many command-line tools (git, python3, rg/ripgrep, npm/npm audit, gh (GitHub CLI), find, sed, grep, etc.). The lack of declared required tooling is an inconsistency: a release checker legitimately needs repository and CLI tools, so those should be declared.
Instruction Scope: noteThe SKILL.md stays on-topic: it inspects repository files, changelogs, versions, tests, dependencies, secrets, and CI status — all expected for a release checker. It explicitly avoids running tests automatically in some places to reduce side effects. However, some checks invoke networked tooling (npm audit, gh run list) which will contact external services and rely on existing CLI authentication. The instructions also search for secrets in repo files: this is appropriate, but any outputs of those scans may contain sensitive data and the skill does not specify how scan output is handled or where it is sent.
Install Mechanism: okInstruction-only skill with no install spec and no code files — nothing will be written to disk by an installer. This is low-risk from an install-mechanism perspective.
Credentials: concernThe skill declares no required environment variables or credentials, yet it calls tools that commonly require credentials or tokens (GitHub CLI 'gh' uses GH auth, npm audit may use registry credentials or internet access). There's a mismatch between declared environment requirements (none) and practical needs (authenticated CLIs or network access). The skill also scans repository contents for secrets; if an agent were to transmit outputs externally, that could expose secrets — the SKILL.md does not constrain where outputs may be sent.
Persistence & Privilege: okThe skill is not always:true and does not request persistent or elevated privileges in the metadata. It does not declare modifying other skills or system-wide config. Autonomous invocation is permitted by default but that is platform standard; no extra persistence privileges are requested.