Skillv2.0.0

ClawScan security

Macro Helper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 17, 2026, 6:53 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's files, runtime instructions, and local scripts are consistent with an Excel/VBA helper: it generates, explains, and templates VBA code and stores small local logs; it does not request credentials or reach out to external endpoints.
Guidance: This skill appears coherent with its stated purpose. Before using it: (1) review the included scripts (scripts/macro.sh and scripts/script.sh) yourself — they are plain shell scripts that generate VBA text and create a data/log directory under $HOME/.local/share/macro-helper by default; (2) never blindly run generated VBA macros in trusted documents — inspect macros before enabling them (VBA can perform file, email, and system actions); (3) be aware the templates include Outlook automation and file operations (the templates show .Display/.Send and file import patterns) — ensure these behaviors match your security policies; (4) if you prefer logs elsewhere, set MACRO_HELPER_DIR before running. No credentials or network access are requested by the skill itself.

Purpose & Capability: okName/description match the provided scripts and SKILL.md. The bash scripts produce VBA code, explanations, templates, and debugging guidance which is exactly what the skill says it does. No unrelated credentials, binaries, or cloud APIs are requested.
Instruction Scope: noteSKILL.md explicitly directs the agent/user to run the included bash scripts (scripts/macro.sh and scripts/script.sh). Those scripts output VBA snippets and helper text; they do not read arbitrary system files or remote endpoints. Note: running the scripts will generate output and the utility script will create a local data/log directory.
Install Mechanism: okNo install spec — instruction-only with included scripts. There are no downloads or external installers. Files are plain shell scripts and docs; nothing writes remote code or pulls archives.
Credentials: noteThe skill requires no environment variables or credentials. The helper script does honor an optional MACRO_HELPER_DIR/XDG_DATA_HOME override for its local data directory; otherwise it writes to $HOME/.local/share/macro-helper. This local storage is reasonable for a utility but is worth noting.
Persistence & Privilege: okalways is false and the skill is user-invocable. The scripts write local logs/data to a per-user data directory but do not modify other skills or system-wide agent settings.