Skillv1.0.0

ClawScan security

Prompt · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 8, 2026, 3:07 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only skill that teaches prompting practices and does not request credentials, install software, or instruct the agent to access files or external systems—its requirements and behavior are coherent with its stated purpose.
Guidance: This skill appears to be a benign, content-only guide for writing better prompts and does not ask for credentials or install software. Before installing, review the full SKILL.md yourself to confirm it doesn't later instruct using external services or storing secrets. As with any prompt library, avoid pasting sensitive data (passwords, API keys, personal identifiers) into prompts or saved examples—those could be stored or reused unintentionally. If you want the skill to store a personal prompt library, check where and how that storage would be implemented (the current package is instruction-only and does not implement storage itself).

Purpose & Capability: okThe skill is a teaching/tooling skill for writing prompts; it contains explanatory content and guidance. It declares no binaries, env vars, installs, or code, which is exactly what you'd expect for an instructional prompt-writing skill.
Instruction Scope: okThe SKILL.md provides prose guidance about prompt design and diagnostics. It does not instruct the agent to read system files, access credentials, call external endpoints, or perform unrelated system actions. (The skill is instruction-only and the provided content is pedagogical rather than operational.)
Install Mechanism: okThere is no install spec and no code to write to disk. Being instruction-only minimizes install risk and there are no third-party downloads or package installs.
Credentials: okThe skill requires no environment variables, credentials, or config paths. Nothing requested is disproportionate to the skill's purpose of teaching and helping craft prompts.
Persistence & Privilege: okThe skill is not marked always:true (it is user-invocable only) and does not request persistent system changes or elevated privileges. disable-model-invocation is false (normal platform default) which simply allows the agent to call skills autonomously; that is not a problem here given the skill's benign content.