Skillv1.0.0

ClawScan security

Hp Company · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 26, 2026, 6:02 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only, content-summary skill about HP; its declared purpose and the runtime instructions are coherent, it requests no credentials or installs, and nothing in the SKILL.md instructs the agent to access external secrets or system files.
Guidance: This skill is an instruction-only summary about HP with no installs or credential requests, so it appears coherent and low-risk. Consider that the source and homepage are unknown — the content is static and in Chinese; if accuracy matters, verify the factual claims against trusted sources before using the information for important decisions. Also remember that, like any skill, it can be invoked by an agent if allowed by your platform settings; if you prefer to restrict autonomous invocation, adjust agent/skill permissions accordingly.

Purpose & Capability: okName, description and SKILL.md all align: the skill is purely a historical/business summary of HP. It does not request unrelated binaries, environment variables, or permissions.
Instruction Scope: okSKILL.md contains only topical guidance and a factual summary (in Chinese). It does not instruct the agent to read files, access environment variables, call external endpoints, or perform other out-of-scope actions.
Install Mechanism: okNo install specification and no code files are present; the skill is instruction-only so nothing is written to disk or installed during setup.
Credentials: okThe skill declares no required environment variables, credentials, or config paths — proportional to a read-only content summary.
Persistence & Privilege: okalways is false and the skill is user-invocable (defaults). The skill may be invoked autonomously by the agent (platform default), which is normal and not by itself a red flag.