Skillv1.0.0

ClawScan security

Peking · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 16, 2026, 7:47 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only skill that simply promises to summarize the Peking brand and does not request credentials, installs, or system access — its declared capabilities align with its requirements.
Guidance: This skill appears internally consistent and minimal-risk: it only provides informational summaries and asks for no secrets or installs. Consider: (1) the source/homepage is unknown — verify critical facts against official sources before using the information in decisions or reports; (2) because it is instruction-only, the agent will rely on its own knowledge or any platform browsing capability — answers may be out of date; (3) if you need guaranteed up-to-date or proprietary data, prefer a skill that links to the official API or website.

Purpose & Capability: okName and description promise brand information; the skill requires no binaries, env vars, or installs, which is consistent for a read/query-style informational skill. Note: source/homepage is unknown, so provenance cannot be independently verified, but this does not create an incoherence between purpose and requested capabilities.
Instruction Scope: okSKILL.md contains only high-level instructions to provide brand history, business overview, market distribution, and competitors. It does not direct the agent to read local files, access environment variables, or send data to external endpoints.
Install Mechanism: okNo install spec and no code files — lowest-risk configuration. Nothing will be written to disk by the skill itself.
Credentials: okThe skill requests no environment variables, credentials, or config paths — access is minimal and proportional to an informational skill.
Persistence & Privilege: okalways is false and the skill is user-invocable (defaults). It does not request permanent presence or system-level changes.