Back to skill
Skillv1.0.0
ClawScan security
ai-article-detector · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 9:38 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its description (a local Node.js detector that fetches a URL and analyzes text); it does not request unrelated credentials or hidden endpoints, but it will fetch whatever URL you give it and installs npm dependencies (so treat network and third-party-package risks accordingly).
- Guidance
- This skill appears to do what it claims: it fetches the article URL you give it and runs local statistical checks to produce a score. Before installing or running it: 1) be aware it will perform HTTP requests to whatever URL is provided — that reveals your agent's IP and User-Agent to the remote host and could be used to access internal endpoints if you pass internal URLs (SSRF-like risk if you supply internal addresses); 2) npm install will download dependencies from the public registry (review or sandbox if you distrust third-party packages); 3) the detector is heuristic/statistical — it can produce false positives and is not legal proof; 4) if you plan to allow autonomous agent invocation, consider restricting which URLs the agent may request or require explicit user confirmation before running the skill against arbitrary links.
Review Dimensions
- Purpose & Capability
- okThe name/description (AI Article Detector) aligns with the included code: ai-article-detector.js fetches a webpage, extracts text with jsdom and computes 8 statistical features to produce a 0–100 score. There are no unrelated requirements (no cloud creds, no system binaries).
- Instruction Scope
- noteSKILL.md simply instructs running node ai-article-detector.js <URL> and describes the 8-dimension analysis. The runtime will perform an HTTP GET of the provided URL (using node-fetch) and parse the returned HTML locally. This is expected for the stated purpose, but note the network fetch means the remote host will see your request (IP/User-Agent) and the code will retrieve arbitrary content you supply.
- Install Mechanism
- noteThere is no packaged install spec; package.json lists dependencies (node-fetch and jsdom). Installing will pull these packages from the public npm registry (normal for Node.js tools). This is moderate risk by default because npm packages are third-party code — expected for this skill but worth reviewing or sandboxing before running.
- Credentials
- okThe skill requests no environment variables, no credentials, and no config paths. All data access is limited to the URL(s) you provide and local analysis — no unexplained secret access.
- Persistence & Privilege
- okThe skill does not request always:true, does not modify other skills or system settings, and is user-invocable only. It can be invoked autonomously by an agent (platform default) but that is not combined with other privilege escalation behaviors here.