Skillv1.0.0

ClawScan security

Decathlon · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 19, 2026, 1:13 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only informational skill about the Decathlon company; it requests no credentials, installs nothing, and stays within its stated purpose.
Guidance: This skill appears safe and coherent: it only provides static information about Decathlon and does not request credentials or install code. Before relying on the facts here (revenue, store counts, market share), verify them against authoritative sources because the package metadata lists no homepage or source — that reduces provenance. If you plan to let agents invoke skills autonomously and you care about provenance, consider restricting autonomous use or reviewing results against trusted references.

Purpose & Capability: noteName/description and the SKILL.md are aligned: the skill provides background, history, and business analysis of Decathlon. However, the skill's source/homepage are unknown, so factual claims (revenue, store counts, percentages) cannot be independently verified from the package metadata; that affects trustworthiness but not coherence.
Instruction Scope: okSKILL.md contains static informational content and triggers (read_when) for relevant queries. It does not instruct the agent to read files, access environment variables, call external endpoints, or collect/transmit user data.
Install Mechanism: okNo install spec and no code files — instruction-only. Nothing is written to disk or downloaded during install.
Credentials: okNo environment variables, credentials, or config paths are requested; requested privileges are minimal and proportionate to an informational skill.
Persistence & Privilege: okalways is false and the skill is user-invocable (normal). Autonomous invocation is allowed (platform default) but the skill's scope is read-only, so there is no elevated persistence or cross-skill configuration.