Skillv1.0.2

ClawScan security

x-df · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 10, 2026, 11:36 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions are consistent with an enhanced df/mount viewer — it only describes running standard system commands and formatting their output, but provenance is unknown and there is no install or source code to audit.
Guidance: This skill appears internally consistent for an enhanced df/mount viewer: it will run standard disk and mount commands and format their output. However: (1) there are no code files or install recipe here — it is instruction-only and relies on an external x-cmd module; verify you obtain x-cmd from a trusted source before installing. (2) The skill source/homepage is unknown, so you cannot audit its implementation; that lowers confidence. (3) Running the skill (or allowing an agent to invoke it) will reveal local disk and mount information — consider whether that data is sensitive in your environment. If you need higher assurance, request the x-cmd/x-df implementation or an install manifest (repository or release URL) to review before enabling.

Purpose & Capability: okName/description match the actions described: combining df and mount (or /proc/mounts) and producing TSV/CSV/TUI output is coherent. References to x-cmd as a dependency are expected for an x-cmd extension.
Instruction Scope: okSKILL.md instructs use of system utilities (df, mount, /proc/mounts, wmic/PowerShell on Windows) and piping into csv/awk/grep — all directly relevant to collecting and formatting disk/mount information. It does not direct reading of unrelated files, environment variables, or transmit data to external endpoints.
Install Mechanism: okNo install spec is included (instruction-only), so nothing will be written or downloaded by this skill itself. It does require x-cmd to be installed separately; the SKILL.md points users to the x-cmd skill for installation options.
Credentials: okNo required environment variables, credentials, or config paths are requested. The runtime actions (reading /proc/mounts, running df/mount/wmic) are proportional to the stated purpose.
Persistence & Privilege: okSkill is not always-on and does not request any special persistent privileges. It does not declare modifications to other skills or system-wide settings.