Back to skill
Skillv0.1.1
ClawScan security
Ngamux · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 15, 2026, 2:54 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only API/usage reference for a Go HTTP router (Ngamux) and its declared requirements and instructions are consistent with that purpose, though the package provenance is unknown.
- Guidance
- This skill is an API reference/usage guide for a Go HTTP router and appears internally consistent. It does not ask for credentials or install anything. However, the package source/homepage is unspecified — before relying on or importing Ngamux into projects, verify the library's origin (official repository or vendor), review its code/license, prefer pinned versions, and only fetch/install packages from trusted sources (e.g., a known GitHub repo or your internal registry). If you expect the agent to fetch or build this library automatically, confirm what commands it will run (go get / go install) and ensure those network operations are acceptable in your environment.
Review Dimensions
- Purpose & Capability
- okName/description match the SKILL.md content: it documents route definition, middleware, request parsing, and response helpers for a Go router. No unrelated credentials, binaries, or config paths are requested.
- Instruction Scope
- okSKILL.md contains an API-style usage guide and examples for routing and middleware only. It does not instruct the agent to read unrelated files, environment variables, or to transmit data to external endpoints.
- Install Mechanism
- okNo install spec and no code files — the skill is instruction-only and will not write or execute code on disk by itself.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. That matches the documented behavior (a usage guide for a Go library).
- Persistence & Privilege
- okThe skill is not marked always:true and uses default invocation settings. It requests no system-level persistence or cross-skill configuration changes.