Back to skill
Skillv0.2.0
ClawScan security
Deprecated Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 3:05 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a deprecated, instruction-only wrapper that simply points users to a renamed skill; it contains no code, requires no credentials, and its content is internally consistent.
- Guidance
- This package is simply a deprecated pointer to the new translate-book skill and contains no code or credentials. It is safe to ignore or uninstall. Before installing the recommended translate-book package, review that package's SKILL.md and source (the GitHub link provided) to verify what binaries (e.g., Calibre), environment variables, or remote calls it requires. Be cautious when running npx or similar one-line installers (they fetch remote code); inspect the repository and release artifacts and prefer installing from a trusted source or pinned release.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description explicitly state it is deprecated and instruct users to install the renamed skill. It does not declare any unrelated requirements or credentials, so its requested footprint matches its stated purpose of redirecting users.
- Instruction Scope
- noteSKILL.md describes the functionality of the new translate-book skill (Calibre, parallel subagents, file conversions, SHA-256 validation) but this deprecated package contains only migration instructions and does not itself instruct the agent to access files, run binaries, or transmit data. The descriptive content is harmless here, but users should inspect the actual translate-book SKILL.md/source before installing it because that implementation may access files and external tools.
- Install Mechanism
- noteThere is no install specification in this package (instruction-only), which is low risk. The README suggests using clawhub or an npx command to add the new skill — npx will fetch and execute remote code, so users should treat that as a separate risk and review the new skill's source before running such installers.
- Credentials
- okThis deprecated skill declares no required environment variables, credentials, or config paths, which is proportionate for a pointer/deprecation notice.
- Persistence & Privilege
- okThe skill does not request always: true and is user-invocable only; it does not modify other skills or ask for persistent privileges. Autonomous invocation remains enabled by default but this package itself does nothing of consequence.