Skillv0.1.0

ClawScan security

360 Zhiniao · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 16, 2026, 10:06 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and instructions are consistent with its stated purpose of summarizing publicly available pages on ai.360.cn and it does not ask for credentials, installs, or unrelated access.
Guidance: This skill appears coherent: it only describes scraping and summarizing publicly accessible pages on ai.360.cn and does not request credentials or installations. Before enabling, consider: (1) you are allowing the agent to access external web pages — ensure you are comfortable with that network activity; (2) the SKILL.md notes pages are dynamic, so a real implementation may require a headless browser or rendering engine (not included here); and (3) scraping should respect robots.txt, rate limits, and the target site's terms to avoid IP blocking or legal issues. If you need guaranteed safeguards (e.g., limit outbound requests or disallow web access), enforce them at the agent/platform level before installing.

Purpose & Capability: okName/description claim: gather public model, pricing, and docs info from 360智脑 public pages. Declared requirements: none. There are no unrelated env vars, binaries, or install steps — the requested capabilities match the stated purpose.
Instruction Scope: okSKILL.md confines actions to visiting and parsing public pages on https://ai.360.cn/, extracting model/pricing/docs info, and respecting rate limits. It explicitly forbids account operations or API calls. The only implementation ambiguity is that pages are dynamic and require waiting/rendering, which is an implementation detail rather than scope creep.
Install Mechanism: okNo install spec and no code files — instruction-only skill. Nothing will be downloaded or written by the skill itself during install.
Credentials: okThe skill declares no environment variables, credentials, or config paths. That aligns with its public-data-only purpose.
Persistence & Privilege: okalways is false and the skill does not request persistent privileges or to modify other skills. Autonomous invocation is allowed (platform default) but not combined with other concerning factors.