Back to skill
Skillv1.0.0
ClawScan security
OGT Docs Create · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 9:24 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only docs-creation helper that is internally consistent: it contains shell commands to create/seed documentation folders and files and does not request credentials, installs, or unrelated system access.
- Guidance
- This skill is coherent with its stated purpose but it will execute shell commands that create and modify files in your repository (mkdir, cp, cat, echo, touch). Before using it: (1) review docs/_templates and the SKILL.md scripts to ensure they do what you expect, (2) run on a disposable branch or backup your repo to avoid accidental overwrites, (3) inspect batch scripts (they assume bash utilities like sed/tr/echo) before running, and (4) if you don't want an agent to modify files autonomously, restrict or review agent actions before they run these commands.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description (create documentation entities) match the actions the SKILL.md instructs (mkdir, cp, echo, create task/feature/rule files). It does not request unrelated credentials, binaries, or config paths.
- Instruction Scope
- noteThe SKILL.md tells the agent to run shell commands that create and modify files under docs/ and CHANGELOG.md (mkdir, cp, cat, echo, touch). This behavior is expected for a docs-creation tool, but it will modify the local filesystem and can overwrite files if used carelessly. The instructions reference docs/_templates which must exist; the agent will not validate that and will perform operations as-is.
- Install Mechanism
- okNo install spec or external downloads — instruction-only. Nothing is written to disk by an installer and no third-party packages are pulled in by the skill itself.
- Credentials
- okThe skill does not request environment variables, credentials, or config paths. The SKILL.md does not read unrelated env vars or secret paths.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system presence or modify other skills' configuration. It will run shell commands when invoked, which is normal for this type of instruction-only skill.