Back to skill
Skillv1.0.0
ClawScan security
Scamper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 9:24 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only SCAMPER brainstorming helper and its requests are generally consistent with that purpose, with a minor note about implicit file read/write behavior.
- Guidance
- This looks like a straightforward, instruction-only SCAMPER helper. Before enabling it: 1) Confirm where notes/ideas.md lives in your environment — the SKILL.md implies the agent will read and append to that file when invoked. 2) Ensure you’re comfortable letting the agent write to that notes file (review outputs before committing). 3) Because the skill can be invoked by the agent, check your platform's file-permission model if you want to restrict file access. If you want higher assurance, request the owner supply a more explicit config option for the ideas file path or a preview step before any writes. If the skill later includes code, network endpoints, or requests credentials, re-evaluate.
Review Dimensions
- Purpose & Capability
- okName and description match the contents of SKILL.md: it implements the SCAMPER creative-thinking method, multiple modes (quick/full/targeted), and integration points for idea workflows. Nothing requested (no env vars, no binaries, no installs) is out of scope for a brainstorming helper.
- Instruction Scope
- noteThe instructions reference reading/append-ing to a path named notes/ideas.md and describe automatically offering to 'SCAMPER this' when new ideas or frameworks are saved. This is coherent with the skill's purpose (operating on saved ideas) but the skill does not declare any required config paths. Users should be aware the agent will read/write a user's notes file if integrated into their environment.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only). This minimizes risk — nothing is downloaded or written to disk by the skill itself.
- Credentials
- okNo environment variables, credentials, or external services are requested. The required privileges are minimal and proportional to a brainstorming assistant.
- Persistence & Privilege
- okalways: false and default invocation settings. The skill does not request persistent or elevated platform privileges and does not modify other skills or system-wide settings.