Skillv1.0.0

ClawScan security

Ads Creative Performance · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 3, 2026, 3:50 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: Instruction-only skill that provides creative-analysis templates and decision rules; it does not request credentials, install code, or access external systems automatically.
Guidance: This skill is a template-driven advisor — it will not fetch data from Meta, TikTok, Google, Amazon, or other ad platforms on its own. If you expect automatic data pulls or live reports, this skill does not provide them (and would need explicit API credentials and an install mechanism to do so). Before using: (1) Do not paste production credentials into free-text prompts — the skill does not request them. (2) Test the skill with non-sensitive sample campaign data to verify outputs. (3) If you need automation, prefer a skill that transparently declares required env vars and an install procedure from a trusted source. (4) Because the publisher/homepage is unknown, exercise the usual caution: prefer skills from known publishers or ask the author for provenance and changelog before granting any credentials or elevated access.

Purpose & Capability: okThe name/description say it will analyze creative performance across multiple ad platforms; the SKILL.md supplies decision rules, input/output contracts, and actionable plans. The skill is instruction-only (no code, no env vars), so its ability to 'analyze' depends on user-supplied data rather than automatic access to platform APIs — this is coherent but important to understand.
Instruction Scope: okRuntime instructions are limited to asking for campaign/product inputs, generating creative plans, QA checks, and escalation guidance. The SKILL.md does not instruct reading local files, environment variables, or calling external endpoints beyond normal output, so it stays within its stated purpose.
Install Mechanism: okNo install spec and no code files are present. No binaries or downloads are requested, so there is nothing written to disk or executed by the skill at install time.
Credentials: okThe skill requests no environment variables, credentials, or config paths. This is proportionate for an instruction-only advisory tool; however, note that direct platform integration would normally require API credentials and an install mechanism, which are intentionally absent here.
Persistence & Privilege: okalways is false (default) and the skill does not request persistent system privileges or modify other skills. It can be invoked by the agent normally; there is no indication of elevated persistence or cross-skill access.