Back to skill
Skillv1.0.0
ClawScan security
Moet Chandon · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 28, 2026, 10:05 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a read-only, instruction-only skill that provides background and reference material about Moët et Chandon and does not request credentials, install code, or perform external actions — its declared purpose matches its content.
- Guidance
- This skill is low-risk: it is an instruction-only, read-only knowledge resource that asks for nothing and installs nothing. Before installing, consider these points: (1) the SKILL.md appears authoritative but may contain minor typos and could be truncated in the provided snapshot — verify any facts you plan to rely on against primary sources; (2) the publisher is unknown and there is no homepage listed, so if you need provenance or citation you may want to prefer a skill from a verifiable author; (3) autonomous invocation is allowed by default (normal for skills) — if you want to limit any automated use, disable or restrict the skill in your agent settings. Otherwise the skill is coherent with its stated purpose.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description (a knowledge resource on Moët et Chandon) match the SKILL.md content which is purely informational. No unrelated binaries, credentials, or config paths are required. Minor inconsistency: SKILL.md's internal name field is 'must-chandon' (typo) while the registry slug is 'moet-chandon' — this looks like a bookkeeping error but not a security problem.
- Instruction Scope
- okSKILL.md is static content and contains reading guidance (read_when) and encyclopedic text. It does not instruct the agent to read arbitrary files, access environment variables, call external endpoints, or transmit data. There is no scope creep in the instructions.
- Install Mechanism
- okThere is no install specification and no code files. Being instruction-only, the skill does not write to disk or fetch external code, which is the lowest-risk installation profile.
- Credentials
- okThe skill does not request any environment variables, credentials, or config paths. The lack of secrets or external-service keys is proportionate to a static knowledge resource.
- Persistence & Privilege
- okThe skill is not force-enabled (always: false) and is user-invocable. Model invocation is allowed (default), which is normal for skills; it does not request elevated persistence or modify other skills or system settings.