Back to skill
Skillv1.0.0
ClawScan security
Account Weight Optimization · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 7, 2026, 2:54 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's description claims a runnable Python tool to optimize account 'weight', but the SKILL.md is vague and references a script that does not exist — the pieces don't add up and more provenance is needed before use.
- Guidance
- Do not install or enable this skill yet. Ask the publisher for the missing optimize.py and for a clear description of: data sources, exactly what credentials (if any) are needed, what network endpoints the tool contacts, and how it modifies accounts or content distribution. If you must test it, request the full source, review it yourself (or have a developer review), and run it in an isolated environment; never provide account passwords or tokens until you understand and verify the code and its compliance with the target platform's terms. If the author can't supply code provenance or explains why no credentials are needed despite claiming to alter account weight, treat it as untrustworthy.
Review Dimensions
- Purpose & Capability
- concernThe skill promises account health/weight optimization and even a python CLI usage line, but the package contains no code and declares no required binaries or credentials. Calling out 'improves algorithm favorability' implies actions that would typically need account access or external APIs, which are not justified by the declared requirements.
- Instruction Scope
- concernSKILL.md only gives a high-level capability list and a single usage example invoking 'optimize.py' under the skill folder. There are no runtime instructions for how account data is obtained, what credentials are needed, or what network calls are made. The usage references a local script that is not present, leaving ambiguous what an agent should actually do.
- Install Mechanism
- okThere is no install spec and no files besides SKILL.md, so nothing is written to disk by the skill itself — this lowers supply-chain risk. However, the lack of code increases ambiguity about intended behavior.
- Credentials
- concernThe skill requests no environment variables or credentials but its stated purpose (operating on platform accounts and altering 'weight' or distribution) would reasonably require access to account tokens, cookies, or platform APIs. The absence of any declared credentials is a mismatch and could mask later requests for sensitive data.
- Persistence & Privilege
- okalways is false and there are no config path modifications or persistent install steps declared. The skill does not request elevated persistence privileges in its metadata.