Skillv2.0.1

ClawScan security

Instagram Caption · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 18, 2026, 10:45 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally consistent with its stated purpose: a local CLI-backed Instagram caption and content-logging tool that stores data under ~/.local/share/instagram-caption and does not request network access or credentials.
Guidance: This skill is a simple local content-logging CLI. Before installing, be aware that: (1) all entries are saved in plain text under ~/.local/share/instagram-caption and export files include those entries; do not store passwords or other secrets there, (2) there are no network calls or credential requirements in the provided script, and (3) review the full script in your environment to confirm there are no later modifications or additional files that introduce network access.

Purpose & Capability: okName/description (caption, hashtags, story/reels scripts, bio optimization, content calendar) match the code and SKILL.md. The script implements local logging, search, export, and stats functionality that fit the described purpose — no unrelated credentials, binaries, or services are requested.
Instruction Scope: noteRuntime instructions and the script operate only on local files under ~/.local/share/instagram-caption, logging entries and exporting them in json/csv/txt. Note: data is stored in plain text and export files are written to the same data directory, so any sensitive text you save will be persisted locally and included in exports.
Install Mechanism: okInstruction-only skill with a provided shell script; there is no install spec that downloads external code. The script is self-contained and uses only standard POSIX utilities.
Credentials: okNo environment variables, credentials, or external config paths are required. The script only uses HOME to determine a local data directory, which is reasonable for a user-facing CLI tool.
Persistence & Privilege: okThe skill does not request always:true and does not modify other skills or system-wide settings. It creates and writes only to its own data directory under the user's home.