Back to skill
Skillv0.1.3
ClawScan security
Smith Matrix · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 7:45 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, instructions, and requested actions are internally consistent with a local, filesystem-based multi‑agent orchestration framework and do not ask for unrelated credentials or external downloads.
- Guidance
- This skill is coherent and self-contained, but it performs filesystem reads/writes — review the files before installing. Because the write/read rules are guidance only (not automatically enforced), run it in an isolated workspace or sandbox first, and avoid pointing tasks at sensitive directories. Verify that you trust the skill source before copying it into your ~/.claude/skills/ directory. If you need stronger guarantees, restrict the agent's filesystem permissions or inspect the generated .smith-matrix contents after each run.
Review Dimensions
- Purpose & Capability
- okName/description describe creating and coordinating multiple local 'Smith' agents; the SKILL.md and supporting docs only require creating and managing a local .smith-matrix directory structure and template files, which is consistent with that purpose.
- Instruction Scope
- noteThe runtime instructions direct the agent to create directories, read and write template and task files under a .smith-matrix tree and to copy smith.md into child directories. This stays within the skill's purpose. Note: these are instructions to perform filesystem I/O — the protocol constrains writes to the skill's own directories, but that constraint is procedural (guidance) not technically enforced by the platform.
- Install Mechanism
- okNo network install or executable downloads are present — the skill is instruction-only and the 'installation' is a simple local copy (cp -r) into a Claude skills directory. This is low-risk compared with arbitrary remote downloads.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. All required operations are local file reads/writes within its own directory tree, matching the declared requirements.
- Persistence & Privilege
- okThe skill is not marked always:true and does not request elevated or cross-skill configuration. It instructs creating files under .smith-matrix and copying into the skills folder (normal for a local skill). Autonomous invocation is allowed but is the platform default and not a unique concern here.