Skillv1.0.0

ClawScan security

CMO Helper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 4, 2026, 7:04 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only CMO planning helper whose requirements and instructions are internally consistent with its stated purpose and it does not request excess credentials, installs, or system access.
Guidance: This skill appears coherent and low-risk as an offline CMO planning helper. Before using: (1) avoid pasting real platform API keys or other secrets into free-text inputs — the skill does not need them; (2) verify inputs (revenue, baseline KPIs) are accurate because outputs are model-driven estimates, not guaranteed outcomes; (3) if you later enable live integrations with ad platforms, expect explicit credential requests and review them carefully; (4) treat forecasts as decision-support, validate with your analytics stack before acting. If you want the skill to pull live campaign data, request documentation on how it plans to authenticate and which endpoints it will call.

Purpose & Capability: okName/description (CMO-level planning across ad channels) matches the SKILL.md: it asks for business targets, budget, current mix and describes simulation, forecasting, and reporting tasks. There are no unrelated environment variables, binaries, or platform credentials requested that would be disproportionate.
Instruction Scope: okSKILL.md contains only modeling, decision rules, scenario workflows, examples, and output contracts. It does not instruct the agent to read local files, access system configuration, call external endpoints, or exfiltrate data. All instructions stay within the declared planning/reporting scope.
Install Mechanism: okNo install spec is provided (instruction-only). Nothing is written to disk or downloaded, which minimizes install-time risk.
Credentials: okThe skill declares no required env vars, no primary credential, and no config path access. That is proportionate to an offline modeling/reporting tool that uses user-supplied inputs.
Persistence & Privilege: okalways:false and user-invocable:true (defaults) — the skill does not request permanent/global presence or attempt to modify other skills or system-wide settings. Autonomous invocation is allowed by platform default but is not combined here with other red flags.