Back to skill
Skillv1.0.0
ClawScan security
挑战杯小挑参赛助手-第十五届创业计划竞赛指南 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 16, 2026, 8:57 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only guidance skill for preparing Challenge Cup (小挑) submissions and generating PPTs via a separate pptx skill; its declared requirements and instructions are coherent with that purpose.
- Guidance
- This skill appears coherent and low-risk, but check a few things before installing: 1) The skill will call an external 'pptx' skill to generate slides—review that pptx skill's permissions and privacy behavior. 2) Do not share sensitive secrets or proprietary IP when providing project details (only share what you are comfortable uploading to a third-party skill). 3) The skill source/homepage is unknown; if you need stronger assurance, ask the publisher for provenance or prefer skills with a verifiable homepage or known author. 4) If the pptx output requires uploading files, review where those files are stored/transmitted and retain copies if needed.
Review Dimensions
- Purpose & Capability
- okThe name/description (competition guidance and PPT creation) match the SKILL.md content. No unrelated credentials, binaries, or installs are requested.
- Instruction Scope
- noteInstructions are scoped to asking the user for project details, giving guidance, and calling an external 'pptx' skill to build slides. Note: the skill delegates PPT generation to another skill (use_skill -> pptx), so the behavior and permissions of that pptx skill are relevant to privacy/security.
- Install Mechanism
- okNo install spec or code files beyond documentation — instruction-only. Nothing is downloaded or written to disk by this skill itself.
- Credentials
- okThis skill requests no environment variables, credentials, or config paths. The information it asks from users (project details, team info) is appropriate for the stated purpose.
- Persistence & Privilege
- okalways is false and the skill does not request persistent/system-level privileges. Autonomous invocation is allowed (platform default) but there is no evidence of elevated persistence or cross-skill configuration changes.