Skillv1.0.0

ClawScan security

Repsol · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 17, 2026, 1:10 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only informational skill that provides a Repsol company overview and market context; its requirements and runtime instructions are consistent with that purpose.
Guidance: This skill appears to be a static, read-only summary of Repsol and related markets and does not request credentials or install software. Before installing, consider: (1) source trust — the skill's Source/Homepage are unknown, so verify accuracy if you rely on it for decisions; (2) currency — financial figures and targets can become outdated, so verify dates and cite primary sources; and (3) hallucination risk — the model may present facts confidently without citations, so cross-check any critical data against official reports or market APIs. If you need live market data or transaction-capable functionality, prefer a skill that explicitly documents its data sources and required credentials.

Purpose & Capability: okThe skill's name and description claim to provide Repsol/company and market information; the SKILL.md contains only static content and query triggers for that topic. It does not request unrelated credentials, binaries, or system access, so requested capabilities align with the stated purpose.
Instruction Scope: okSKILL.md is a self-contained summary and guidance for when to read/provide Repsol-related information. It does not instruct the agent to read files, access environment variables, phone home, or query external endpoints beyond serving the informational content, so scope is limited to the advertised topic.
Install Mechanism: okThere is no install spec and no code files (instruction-only), so nothing is written to disk and no external packages are fetched — minimal installation risk.
Credentials: okThe skill declares no required environment variables, no credentials, and no config paths. That is proportionate for a read-only informational skill.
Persistence & Privilege: okThe skill is not marked always:true and uses default model invocation settings. It does not request elevated or persistent privileges beyond normal skill invocation.