Back to skill
Skillv1.0.3
ClawScan security
Nansi website and web app builder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 23, 2026, 3:40 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions and requirements are internally consistent: it simply tells the agent to collect business details from the user (with consent) and send them to a specific WhatsApp number to build a site.
- Guidance
- This skill is coherent with its purpose, but remember it will transmit anything you explicitly provide to an external WhatsApp number (+233540311706). Before proceeding: (1) confirm you consent to sending the business details; (2) avoid sharing passwords, financial data, or personally identifying information you don't want sent; (3) be cautious when sending images or voice notes — they could contain sensitive data; (4) verify the service (look for a privacy policy, terms, or a legitimate website) if you plan to use it for real business data; (5) if the agent will answer follow-up questions on your behalf, require explicit confirmation from you before sending any additional or new information.
Review Dimensions
- Purpose & Capability
- okThe name/description (WhatsApp-based website builder) match the runtime instructions (send messages to +233540311706 and relay responses). The skill does not request unrelated credentials or binaries.
- Instruction Scope
- noteInstructions stay within the stated purpose (gather site details, ask consent, send messages and relay the preview URL). However, the procedure allows the agent to transmit attachments (images, voice notes) and to answer follow-up questions on the user's behalf; this creates a risk of unintentionally sharing extra or sensitive information unless the user is explicit. The skill promises to ask consent before the first message, but later follow-ups may require re-confirmation for additional data or attachments.
- Install Mechanism
- okInstruction-only skill with no install step or downloaded code, so nothing is written to disk and there is no install-time risk.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The instructions assume the platform can send WhatsApp messages but do not ask for WhatsApp API tokens — that is reasonable for an instruction-only skill, though the platform must provide the messaging capability.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-wide changes or elevated privileges. It does not attempt to modify other skills or system config.