Back to skill
Skillv1.0.0
ClawScan security
Tmpfiles Upload (Stdlib) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 26, 2026, 3:23 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions align with its stated purpose (uploading an existing local file to tmpfiles.org using only the Python standard library); nothing requested appears disproportionate or unrelated.
- Guidance
- This skill appears coherent and limited to uploading a local file to tmpfiles.org and returning JSON. Before using it: (1) only provide paths for non-sensitive files you are willing to make publicly accessible (tmpfiles creates temporary public links), (2) be aware the example reads the whole file into memory — avoid very large files or modify to stream, (3) test with a harmless file first to confirm network access and response format, (4) consider private alternatives (S3, Supabase) for confidential data, and (5) verify tmpfiles.org retention/privacy policies if that matters for your use case.
Review Dimensions
- Purpose & Capability
- okName/description, declared requirements (python3, linux) and runtime instructions all focus on uploading a local file to tmpfiles.org and returning a JSON link. No unrelated credentials, binaries, or install steps are requested.
- Instruction Scope
- noteThe SKILL.md confines actions to checking a provided local path, reading the file, and POSTing it to tmpfiles.org; it explicitly warns against uploading secrets. Minor operational gaps: no explicit file-size or streaming guidance (files are read fully into memory in the example), and the reference implementation prints a raw_response on error which could include server data. These are practicality/robustness notes rather than scope creep.
- Install Mechanism
- okThis is an instruction-only skill with no install spec, so nothing will be downloaded or written to disk by install. Lowest-risk install posture.
- Credentials
- okNo environment variables, keys, or config paths are requested. The skill does not ask for unrelated credentials or elevated access.
- Persistence & Privilege
- okalways is false, model invocation is allowed (platform default). The skill does not request persistent system presence or modify other skills/configuration.