Skillv1.0.0

ClawScan security

market-structure · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 19, 2026, 5:08 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only market-structure analysis guide and its declared requirements and runtime instructions are consistent with that purpose.
Guidance: This skill is instruction-only and internally consistent with its stated purpose. Before installing, consider: (1) it provides trading methodology, not guaranteed profitable signals — validate outputs with your own analysis and risk management; (2) the agent will need chart images or price data you supply to produce useful results — do not upload sensitive credentials or private account screenshots you don't want shared; (3) do not grant the agent trading-account API keys or automated execution permissions unless you explicitly trust and audit any automation; (4) because the skill encodes a specific methodology (SMC/ICT), check that you want that style of analysis and cross-check with other sources. Overall this appears coherent and low-risk from a security perspective.

Purpose & Capability: okName and description match the SKILL.md content: the skill is purely a trading market-structure analyst (SMC/ICT/classical TA). It requires no binaries, credentials, or config paths that would be unrelated to this purpose.
Instruction Scope: okSKILL.md contains detailed, prescriptive analysis steps (trend, swings, BOS/CHoCH, order blocks, FVG, bias). It does not instruct the agent to read system files, environment variables, or send data to external endpoints. All instructions stay within the stated trading-analysis scope.
Install Mechanism: okNo install spec and no code files — instruction-only. This minimizes footprint; nothing is downloaded or written to disk.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. There is no disproportionate access requested relative to its purpose.
Persistence & Privilege: okalways is false and the skill does not request persistent system privileges or attempt to modify other skills or global agent settings.