Skillv1.0.1

ClawScan security

URL Slug生成器 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 29, 2026, 4:23 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, instructions, and requirements align with its stated purpose (generating SEO-friendly slugs from Chinese text) and it does not request credentials, install remote code, or perform network or unexpected file access.
Guidance: This skill is coherent and low-risk: it runs a local Python script to produce slugs and does not contact the network or request credentials. Before running, you may want to: (1) inspect the included script (it's short and readable) to confirm it meets your expectations; (2) install pypinyin from PyPI only if you need pinyin mode (pip install pypinyin); (3) be aware that --batch can read a local file you point it to and --output will overwrite the specified file. If you plan to run untrusted code in general, run it in a controlled environment (container/VM).

Purpose & Capability: okName/description (Chinese→slug, optional pinyin) match the included Python script and SKILL.md. The script implements dictionary-based translation, a pinyin fallback, batch mode, and output-to-file — all consistent with the advertised features.
Instruction Scope: okSKILL.md only instructs running the bundled script with CLI args. The runtime instructions reference only local inputs (positional text, stdin or a local file for batch mode) and an optional --output file. They do not instruct reading unrelated system files, environment variables, or contacting external endpoints.
Install Mechanism: okThere is no install spec; this is an instruction-only skill with a single included script. The only optional dependency is pypinyin (installed via pip) for pinyin mode, which is reasonable and expected.
Credentials: okThe skill requires no environment variables, no credentials, and no config paths. The code does not access secrets or external services. The optional pypinyin dependency is local and limited to pinyin conversion.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not modify other skills or system configuration and only writes output when the user provides --output (or when batch mode reads a provided file path).