Skillv2.0.0

ClawScan security

Name Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 17, 2026, 6:56 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally consistent with a local name-generation utility: it runs included shell/Python scripts, does not request credentials or remote installs, and only stores modest data under the user's data directory.
Guidance: This skill appears to be a local name-generator and is coherent with its description. It does not ask for credentials or contact external services. Before installing, note that the bundled utility will create a data directory (default: $XDG_DATA_HOME or $HOME/.local/share/name-generator) and write logs/data (history.log, data.log). If you prefer no files written, set NAME_GENERATOR_DIR to a location you control or inspect/modify the scripts to avoid persistent storage. If you want extra assurance, review the remainder of scripts/name.sh (the file was long/truncated in the listing) to confirm there are no hidden network calls or eval/exec of untrusted input.

Purpose & Capability: okName Generator's declared purpose (baby names, brand/pen/English names) matches the included scripts and SKILL.md examples. There are no unrelated binaries, cloud credentials, or unexpected service integrations requested.
Instruction Scope: okSKILL.md instructs the agent to run the bundled scripts (scripts/name.sh). The scripts generate names locally, do not call external endpoints, and do not read arbitrary system files or secrets. The SKILL.md does not explicitly mention that the companion utility creates local data files, which the scripts do (see persistence).
Install Mechanism: okThere is no install spec or external download. All code is bundled with the skill; runtime uses system bash and python3 (both common). No URLs, archives, or third-party package installs are used.
Credentials: noteThe skill does not require credentials or declared env vars. The included scripts reference standard environment variables (NAME_GENERATOR_DIR, XDG_DATA_HOME, HOME) to decide where to store data; this is proportional to a local utility but worth noting because the scripts will read those env vars if set.
Persistence & Privilege: notescripts/script.sh creates and writes files under a data directory (default: $XDG_DATA_HOME or $HOME/.local/share/name-generator) — it logs history and appends to a data.log. always is false and the skill does not request elevated privileges; the persistence is limited to the user's data directory.