Back to skill
Skillv0.1.1
ClawScan security
Company Research · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 3:33 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions are consistent with doing company research via Exa search; it does not ask for credentials or install anything, but it does assume the agent can run Exa advanced searches, spawn task agents, and (optionally) use a browser-based Claude fallback.
- Guidance
- This skill appears coherent for doing company research with Exa. Before installing, confirm these runtime capabilities and privacy trade-offs: (1) your agent environment must provide the web_search_advanced_exa tool and the ability to spawn Task agents — otherwise the instructions may be impossible to follow; (2) the SKILL.md instructs an automatic fallback to using 'Claude in Chrome' for gated or dynamic content — that will send query content to a different external service (Anthropic/Claude via a browser) and may leak sensitive queries or PII to that service; (3) although the skill doesn't request secrets, any queries you send (company internal docs, private identifiers) could be transmitted to external search endpoints — avoid including sensitive or proprietary data in queries unless you trust the target services and network; (4) if you don't want automatic cross-service fallbacks, disable or modify the fallback behavior before use. If you need, ask the skill author to remove or clarify the Claude/browser fallback and to document required runtime tools explicitly.
Review Dimensions
- Purpose & Capability
- okThe name/description (company research via Exa) matches the SKILL.md: all instructions are about constructing Exa queries, tuning results, and returning distilled company research. There are no unrelated env vars, binaries, or install steps requested.
- Instruction Scope
- noteOverall instructions stay within research scope (query generation, deduplication, result merging, output format). Two items to note: (1) SKILL.md mandates spawning Task agents / isolating searches from the main context — this is a focused design decision but presumes the runtime supports task agents; (2) it explicitly instructs an auto-fallback to 'Claude in Chrome' for auth-gated/dynamic pages, which will send data to an additional external service and relies on a browser integration not declared in the skill metadata. These are not necessarily malicious but are extra capabilities the runtime must provide and that expose queries to another vendor.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files. Lowest-risk footprint: nothing is written to disk or downloaded by the skill itself.
- Credentials
- okNo environment variables, credentials, or config paths are requested. This aligns with the described purpose which uses an external search tool rather than secret-bearing APIs.
- Persistence & Privilege
- okalways is false and agent-autonomous invocation is allowed (default). The skill does instruct creating Task agents for isolation, but it does not request permanent presence or system-wide config changes.