Skillv1.0.0

ClawScan security

supplier-risk-scoring · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignMar 3, 2026, 10:22 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: This is an instruction-only supplier risk scoring framework that is internally consistent with its stated purpose and does not request installs, credentials, or unusual system access — but it depends on external/paid data sources and user-supplied sensitive vendor information, so review privacy and data-access practices before use.
Guidance: This skill is a reusable rubric — it doesn't install code or ask for credentials — but it expects you (or the agent) to gather potentially sensitive vendor data from third parties or to upload vendor financial/legal documents. Before using it: (1) Confirm how you will supply data (manual input vs. agent web access vs. paid API) and whether you need to provide any API keys or paid reports; (2) Do not paste confidential vendor contracts, bank account details, or personally identifying customer data into an agent unless you are comfortable with where that data will be stored or transmitted; (3) If you want automated lookups (D&B, Experian, SEC), plan for legitimate API access and validate licensing; (4) Consider organizational privacy/compliance policies for sharing vendor financials and legal histories; (5) If you allow autonomous agent invocation, supervise first runs to ensure the agent requests and handles only the data you intend it to collect. I have moderate confidence because the provided SKILL.md appears coherent, but I could not review the file beyond what was supplied — if the full SKILL.md contains hidden instructions to access local files, environment variables, or to call arbitrary external endpoints, reassess and share those sections for a more confident evaluation.

Review Dimensions

Purpose & Capability: okThe name and description (Supplier Risk Index, 0-100 score across five dimensions) match the SKILL.md content. The skill is instruction-only and requires no binaries, installs, or credentials — which is coherent for a rubric/assessment tool that expects human-supplied inputs or public research rather than automated API integration.
Instruction Scope: noteThe instructions tell the agent/user to collect data from public/third-party sources (Dun & Bradstreet, SEC filings, LinkedIn, news, vendor-supplied financials) and to evaluate multiple vendor-specific indicators. The SKILL.md does not instruct the agent to read arbitrary local files or environment variables, nor to transmit data to unknown endpoints. However, it does implicitly expect either manual input or web lookups of potentially sensitive vendor financial and legal data; the skill does not provide integration steps or API keys for paid sources, so the workload falls to the user or the agent's web access. This creates privacy/operational considerations (see guidance).
Install Mechanism: okNo install spec and no code files — the skill is instruction-only, which minimizes installation risk (nothing is written to disk or executed by default).
Credentials: okThe skill declares no required environment variables, no primary credential, and no config paths. The external data sources mentioned are appropriate to the purpose, but the SKILL.md does not request API keys or credentials — meaning the user must either supply data manually or provide their own credentials if they want automated lookups.
Persistence & Privilege: okalways is false and there are no indications the skill requests persistent system privileges or modifies other skills. The skill is user-invocable and may be invoked autonomously by the agent (platform default); this is normal and not by itself concerning.