Skillv1.0.1

ClawScan security

Brand DNA — Universal Brand Bible Builder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 25, 2026, 4:48 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This instruction-only Brand Bible skill is internally consistent with its stated purpose and requests no credentials or installs; it appears to be what it claims to be.
Guidance: This skill appears coherent and safe in that it doesn't request credentials or install code. Before using: (1) avoid pasting highly sensitive personal data (e.g., full SSNs, unredacted private legal docs) into the brand template — founder story can contain PII; (2) be cautious following the external link (contentai-suite.vercel.app) — only use it if you trust that third party; (3) if you plan to integrate this with other content skills, review those skills' permissions and data handling so your Brand DNA isn't forwarded to untrusted endpoints; (4) because the skill source/owner is unknown, consider testing it with fictional/example brand data first. If you want, I can review specific other content skills (Blog Master, Instagram Master, etc.) for consistency and risks before you connect them.

Purpose & Capability: okThe name and description match the SKILL.md instructions: it asks the user for brand details and defines a template for generating a Brand Bible. There are no unrelated binaries, environment variables, or config paths requested.
Instruction Scope: noteThe instructions stay focused on producing a Brand Bible and provide a clear template and sections. Note: the SKILL.md references integration with other content skills and a third-party site (contentai-suite.vercel.app) as an optional integration point; the skill itself does not instruct automatic transmission of user data to that site, but users should be aware of the external link and the recommendation to 'Always load Brand DNA first' when using other skills.
Install Mechanism: okNo install spec and no code files are present (instruction-only), so nothing will be written to disk or installed by the skill itself.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. The data it asks the user to provide (brand name, niche, founder story, etc.) is proportional to its purpose.
Persistence & Privilege: okThe skill does not request permanent presence (always is false) and does not ask to modify other skills or system settings. The guidance to load this skill before other content skills is a usage recommendation, not a programmatic privilege escalation.