Skillv1.0.2

ClawScan security

Social Media Metrics · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignMar 14, 2026, 5:55 AM

Verdict: Benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's code, instructions, and requested resources are consistent with a web-scraping follower-count tool, but it requires running a local browser and will persist a browser profile/cookies — review that behavior before installing on shared or sensitive machines.
Guidance: This skill is coherent with its stated purpose and implements scraping for many platforms. Key things to consider before installing: - It needs Playwright and will launch a real Chrome process for some sites; follow SKILL.md to install browsers. - For Xiaohongshu (and some others) you'll be asked to log in by scanning a QR code; the script persists cookies to ~/.playwright_cdp_profile so future runs reuse the session. If you don't want persistent sessions, delete that folder between runs. - The skill opens a local DevTools/remote-debugging port (19222) to connect Playwright to Chrome — the port is bound to localhost but avoid running this on untrusted or public servers. - No hidden remote endpoints or secret-exfiltration code were found in the reviewed files, and no unexpected environment variables are required (YOUTUBE_API_KEY is optional and documented). Recommendations: run the skill on a personal or isolated machine (not a shared CI/hosted environment), inspect the code yourself if you need stronger assurance, and remove ~/.playwright_cdp_profile when finished if you want to clear persisted sessions. If you prefer less browser interaction, supply a YOUTUBE_API_KEY for YouTube or run the tool in an isolated VM/container.

Review Dimensions

Purpose & Capability: okThe name/description (fetch follower counts from many platforms) matches the included code and SKILL.md. Platform modules implement browser scraping and API usage (YouTube API optional). No unrelated credentials or services are requested.
Instruction Scope: noteInstructions are focused on installing Python deps and Playwright, running the included scripts, and using URL/nickname inputs. They explicitly require running a real Chrome instance for some platforms and instruct the user to authenticate (QR scan) for Xiaohongshu. The instructions do not ask for unrelated system files or external endpoints beyond target platforms, but they do rely on interactive browser use and persistent cookies.
Install Mechanism: okNo opaque or network-download install is present; dependencies are standard Python packages (requests, playwright, beautifulsoup4) and Playwright's browser install. The repository includes the scraper code, and the SKILL.md documents the pip/playwright install steps. This is proportional to the task.
Credentials: okThe skill requires no secrets by default. An optional YOUTUBE_API_KEY is supported (documented) to use the YouTube API; otherwise the skill falls back to browser scraping. No unrelated environment variables or credentials are requested.
Persistence & Privilege: concernThe BrowserManager launches a real Chrome process connected over CDP and uses a persistent profile at ~/.playwright_cdp_profile. That directory will store cookies/sessions (intended for Xiaohongshu login). The code also opens a local remote-debugging port (19222) and connects Playwright to it. These behaviors are necessary for reliable scraping on some Chinese platforms but increase persistence/sensitivity: cookies and sessions are written to disk and a local debugging port is exposed (bound to localhost).