Skillv1.0.0

ClawScan security

Best Buy · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 19, 2026, 2:19 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only, read-only company profile about Best Buy that requests no credentials, installs nothing, and is internally consistent with its stated purpose.
Guidance: This skill is low-risk: it only contains static company information and asks for nothing from your environment. Before relying on the data, note the source is 'unknown' and there are no citations — verify any important facts independently. Because it is user-invocable and allowed to be called autonomously by default, only enable it if you trust the publisher; otherwise invoke it manually when needed.

Purpose & Capability: okName, description, and provided materials are a company profile/analysis; the skill does not request unrelated binaries, credentials, or config paths, which matches the stated purpose.
Instruction Scope: okSKILL.md contains only informational content and 'read_when' triggers related to researching Best Buy, industry, and investment analysis. It does not instruct the agent to read system files, access environment variables, call external endpoints, or exfiltrate data.
Install Mechanism: okNo install specification or code files are present; this is instruction-only so nothing is written to disk or downloaded during install.
Credentials: okThe skill declares no required environment variables, no primary credential, and no config paths — fully proportionate for a read-only informational skill.
Persistence & Privilege: okalways is false and the skill is user-invocable (defaults). It does not request permanent presence or modify other skills or system-wide settings.