v1.0.0

Cc Clean

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:32 AM.

Analysis

The artifacts do not show malicious behavior; this appears to be a content-calendar generator, but users should notice the under-declared Anthropic API/Python setup and treat compliance claims as drafting aids.

GuidanceThis looks safe to treat as a drafting/content-calendar skill, but before using it you should verify any Python script and package source, understand that an Anthropic API key may be used, and manually review generated posts—especially regulated or public-facing content—before publishing.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

install:\n      - kind: uv\n        package: anthropic ... python3 generate_calendar.py --niche="DFW real estate"

SKILL.md references installing a Python package and running a helper script, while the provided manifest contains only SKILL.md and no install spec or code file. This is not suspicious by itself, but the runnable implementation/provenance is incomplete in the reviewed artifacts.

User impactA user or agent may need to locate or create unreviewed runnable code before the documented commands work.

RecommendationVerify the exact script and package source before running anything, and prefer a package/skill version whose install requirements and code are declared in the registry.

Human-Agent Trust Exploitation

SeverityInfoConfidenceMediumStatusNote

SKILL.md

`--compliance-only` — check any copy for forbidden words before posting

The skill advertises compliance-oriented checking for generated marketing copy. This may be useful, but the visible artifact frames it as a forbidden-word check, not a full legal or platform-compliance review.

User impactUsers in regulated areas like mortgage, healthcare, crypto, or finance could overtrust generated copy if they assume this feature guarantees compliance.

RecommendationTreat the output as draft marketing copy and review regulated or high-impact posts with appropriate human compliance/legal checks before publishing.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

requires:\n      env:\n        - ANTHROPIC_API_KEY ... primaryEnv: ANTHROPIC_API_KEY

The skill expects an Anthropic API key, which delegates use of the user's provider account and quota. This is purpose-aligned for LLM-generated content, but it is not reflected in the registry metadata that lists no required environment variables or primary credential.

User impactIf used with an API key, the skill may consume Anthropic API quota and send the user's calendar-generation inputs to the model provider.

RecommendationUse a limited or dedicated Anthropic key if possible, monitor usage, and avoid putting secrets or sensitive personal data into prompts.