Back to skill
Skillv1.0.0
ClawScan security
Off White · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 22, 2026, 12:03 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only informational skill about the Off-White brand and its runtime instructions, requirements, and lack of installs/credentials are consistent with its stated purpose; no sensitive access or external installs are requested.
- Guidance
- This is an informational, instruction-only skill about the Off-White brand and appears internally consistent: it requests no credentials and installs nothing. Two practical checks before installing: (1) confirm the platform honors the registry's 'always: false' flag (SKILL.md contains 'trigger: always_on' which may be an author note or a mismatch), and (2) note the skill has no listed homepage or known publisher—if provenance matters to you, prefer skills with verifiable owners or documentation. Otherwise this skill poses low risk for credential exposure or disk writes.
Review Dimensions
- Purpose & Capability
- okName, description, and content are all informational about the Off-White brand. The skill requires no binaries, no environment variables, and no installs — which is appropriate for an encyclopedia-like knowledge skill.
- Instruction Scope
- noteSKILL.md is purely content (history, business model, facts) and does not instruct the agent to read files, call external endpoints, or access credentials. One minor inconsistency: the top of SKILL.md contains the line 'trigger: always_on', which suggests the author intended the content to be always available; that conflicts with the registry metadata (always: false). This is likely a metadata/instruction mismatch rather than malicious behavior, but it is worth verifying how the host platform interprets the SKILL.md trigger.
- Install Mechanism
- okNo install spec and no code files are present. Instruction-only skills have the lowest install risk because nothing is written to disk or fetched at install time.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths — appropriate for an informational skill that doesn't integrate with external services.
- Persistence & Privilege
- noteRegistry flags show 'always: false' and normal autonomous invocation settings. The SKILL.md 'trigger: always_on' text is inconsistent with the registry flag; verify with the platform which takes precedence. There is no request to modify other skills or system settings.