Skillv1.0.0

ClawScan security

Crest · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 30, 2026, 10:05 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only, informational skill about the Crest toothpaste brand; it requests no credentials, installs nothing, and its instructions are limited to static content.
Guidance: This skill is informational only and appears coherent with its stated purpose: it contains static content about the Crest brand, asks for no credentials, and installs nothing. The main non-technical caveat is provenance: the source and homepage are unknown, so the content may be unvetted or out of date; if you need authoritative or up-to-date product/technical information, prefer skills or sources with clear authorship or official links. Otherwise it's low-risk to enable, but it also provides no interactive integrations or functionality beyond reading the included text.

Purpose & Capability: okName/description (Crest toothpaste brand) match the SKILL.md content (brand history, market, tech). The skill requires no binaries, env vars, or config paths, which is proportionate for an informational skill.
Instruction Scope: okSKILL.md contains only static informational text and a small read_when metadata list. It does not instruct the agent to run commands, read files, access environment variables, or transmit data to external endpoints.
Install Mechanism: okNo install spec and no code files are present (instruction-only). No downloads, extracts, or package installs are requested.
Credentials: okThe skill declares no required environment variables, credentials, or config paths — appropriate for a read-only informational skill.
Persistence & Privilege: okalways is false and the skill does not request persistent or elevated privileges. Autonomous invocation is allowed (the platform default) but the skill's content does not suggest any expanded capability.