Back to skill
Skillv1.0.0
ClawScan security
Lpga · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 16, 2026, 6:48 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only, read-only informational skill about the LPGA tour that declares no installs, no credentials, and no system access — its actual footprint matches its description.
- Guidance
- This skill is a simple informational binder about the LPGA with no code, installs, or credential requirements — that's why it's rated benign. Before installing, consider whether you trust the anonymous publisher (no homepage/source listed). Even though the skill itself doesn't request network access or secrets, the agent platform may still fetch updated info at runtime; if you require provenance, prefer skills with a known owner or a homepage. Otherwise, this skill appears safe and proportionate to its stated purpose.
Review Dimensions
- Purpose & Capability
- okName/description (LPGA tour information) match the SKILL.md content. The skill does not request any unrelated binaries, env vars, or config paths; nothing appears disproportionate to providing informational content.
- Instruction Scope
- okSKILL.md contains only static informational content and a short 'read_when' guidance. It does not instruct the agent to read files, access environment variables, call external endpoints, or perform actions beyond presenting LPGA information.
- Install Mechanism
- okNo install specification or code files are present. Because it's instruction-only, nothing is written to disk or fetched at install time.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. There are no opaque or excessive secret requests to justify.
- Persistence & Privilege
- okalways is false, the skill is user-invocable and may be invoked autonomously (platform default). It does not request elevated persistence or modify other skills or system-wide settings.