Back to skill
Skillv4.0.0
ClawScan security
Geoip · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 23, 2026, 1:06 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it provides static reference documentation via a bundled shell script and SKILL.md, requests no credentials, performs no network I/O, and its files match the stated purpose.
- Guidance
- This skill appears safe and does exactly what it claims: provide static Geoip reference text. Before installing, consider whether you actually need a local CLI-style reference (it contains no dynamic lookup features). If you want networked GeoIP lookups or integration with external services, this skill does not provide that. As always, install from the official repository you trust and review updates for new behavior; although this version is benign, future changes could add external calls or credential use.
Review Dimensions
- Purpose & Capability
- okName/description (geoip reference) match the included assets: SKILL.md documents commands and the script prints static reference text. No unrelated credentials, binaries, or config paths are requested.
- Instruction Scope
- okSKILL.md instructs the agent to output plain-text reference docs and explicitly states no external API calls or network access. The runtime script only prints canned heredocs and does not read external files, environment variables, or send data anywhere.
- Install Mechanism
- okNo install spec is provided (instruction-only skill with a small helper script). Nothing is downloaded or extracted from external URLs during install; bundle contents are simple and transparent.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The script does not access environment secrets or external services.
- Persistence & Privilege
- okThe skill does not request always:true and is user-invocable only. It does not modify other skills or system-wide settings; autonomous invocation is allowed by default but the skill's behavior is limited and safe.