Skillv1.0.0

ClawScan security

Duke University · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 19, 2026, 7:43 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is a read-only informational skill about Duke University; it requests no credentials, installs nothing, and its instructions are limited to presenting factual content — the pieces are internally consistent.
Guidance: This skill appears to be a harmless informational profile of Duke University. Before relying on it for decisions (investment, research, citation), verify facts against authoritative sources because the SKILL.md has no source citations and contains a few inconsistent or repeated data points. Because it requests no credentials and does not install anything, privacy and credential risk are minimal.

Purpose & Capability: okName/description (an informational profile of Duke University) matches the SKILL.md content. The skill does not declare any capabilities, credentials, or dependencies beyond presenting university information, which is proportionate.
Instruction Scope: okSKILL.md contains only static descriptive content and a short 'read_when' trigger list indicating when the content should be used. It does not instruct the agent to read arbitrary files, access environment variables, call external endpoints, or transmit data — scope stays within the stated purpose.
Install Mechanism: okNo install spec and no code files; nothing is written to disk or downloaded. This is the lowest-risk pattern for a skill that only provides documentation.
Credentials: okThe skill requires no environment variables, credentials, or config paths. No sensitive access is requested, which is appropriate for a purely informational skill.
Persistence & Privilege: okalways is false and there is no request for permanent elevated privileges or modifications to other skills. Autonomous invocation is allowed by platform default but the skill's read-only nature keeps its blast radius small.