Skillv1.2.1

ClawScan security

Meme Lord · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 9, 2026, 7:42 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's claims (identify, create, chain, and fuse Chinese memes) align with its instructions (web searches + creative generation); it is instruction-only, requests no credentials, and has no install steps—nothing appears disproportionate or unexpected.
Guidance: This skill is coherent with its purpose: it will perform web searches and fetch external pages to identify and source memes, and will generate creative output locally. Consider: (1) outbound web requests may send user-provided meme text to external search/fetch services — avoid submitting sensitive or private content in queries; (2) if the platform asks you to supply a Perplexity/other web-search API key, only provide keys you trust and are comfortable sharing with the skill runtime; (3) the skill explicitly says it will avoid political/abusive content, but moderation errors are possible — monitor outputs for harmful content. If you want tighter control, disable autonomous invocation or only call the skill manually.

Purpose & Capability: okThe name/description (meme detection/creation/fusion) matches the runtime instructions: perform web searches to source memes and generate/transform content. No unrelated binaries, creds, or installs are required.
Instruction Scope: noteSKILL.md directs the agent to run two-stage web searches (broad then precise), fetch source URLs, and label credibility. This reasonably fits the stated purpose but does require outbound web access and fetching/parsing of external pages; the doc also instructs fallback to model memory when no sources are found. It does not direct access to local files or unrelated environment variables.
Install Mechanism: okNo install spec or code files — instruction-only skill. No downloads or binaries written to disk, which minimizes install-time risk.
Credentials: okThe skill declares no required environment variables or credentials. It mentions optionally using a 'web_search (Perplexity) API key' if available, which is reasonable and optional; otherwise it relies on platform web_fetch capabilities. No extraneous secrets are requested.
Persistence & Privilege: okalways is false and the skill is user-invocable; it does not request permanent presence or modification of other skills or system-wide settings.