Back to skill
Skillv1.0.0
ClawScan security
Ads CRM Leads · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 3, 2026, 3:52 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only planner for scoring and routing ad-generated leads and its declared requirements and instructions are coherent with that purpose.
- Guidance
- This skill is a planner/consultant that outputs lead-validation, scoring, routing, and SLA recommendations; it does not integrate with ad platforms or request credentials. If you expect automated syncing with Meta/Google/TikTok/YouTube, you'll need a separate connector skill or code that does require platform API keys—review those connectors carefully before providing credentials. Test the skill with synthetic or non-sensitive lead data first, and ensure any real PII is handled according to your privacy and compliance requirements.
Review Dimensions
- Purpose & Capability
- okThe name and description (lead scoring, routing, SLA, follow-up cadence across ad platforms) match the SKILL.md's workflows and decision rules. The skill does not request unrelated binaries, credentials, or config paths. Minor note: trigger keywords include additional platforms (amazonads, shopifyads, dsp) beyond the 'Primary scope' list — this is a small inconsistency but does not indicate malicious intent.
- Instruction Scope
- okSKILL.md contains only guidance for validating lead schema, scoring, routing, SLAs, and escalation. It does not instruct the agent to read local files, access environment variables, or transmit data to third-party endpoints. The instructions stay within the stated purpose of producing actionable plans rather than performing integrations.
- Install Mechanism
- okNo install spec or code files are present (instruction-only). Nothing is written to disk and no external download or package installs are required.
- Credentials
- okThe skill declares no required environment variables or credentials, which is proportionate for a planning/consulting skill. If you expect direct platform integration or automated API calls, separate connector code and platform credentials would be needed; their absence here means the skill will not itself access ad platforms.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. It does not request persistent system privileges or attempt to modify other skills or system-wide settings.