Back to skill
Skillv1.0.0
ClawScan security
Swatch Group · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 25, 2026, 11:10 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- An instruction-only informational skill about the Swatch Group; its requirements and instructions are consistent with a read-only reference document.
- Guidance
- This skill is a static, read-only reference about the Swatch Group and appears internally consistent and low-risk: it asks for no credentials, installs nothing, and contains only content. Consider these points before installing: (1) provenance is unknown (no homepage or trusted publisher listed), so verify facts against official sources if you need authoritative or up-to-date information; (2) although benign, the skill could contain factual errors or untranslated sections—treat it as a secondary reference; (3) the skill can still be invoked autonomously by agents by default, but given its read-only nature this does not materially increase risk. If you require vetted or current corporate data, prefer official Swatch Group channels or recognized databases.
Review Dimensions
- Purpose & Capability
- okName/description (Swatch Group company overview) match the SKILL.md content (history, brands, business model, metrics). The skill requests no binaries, env vars, or config paths — proportionate for an informational/reference skill.
- Instruction Scope
- okSKILL.md contains only static content (timeline, analysis, facts). There are no runtime commands, file reads, or instructions to access external endpoints or credentials.
- Install Mechanism
- okNo install spec and no code files. Instruction-only skills present the lowest install risk because nothing is written to disk or executed.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths — appropriate for a purely informational skill.
- Persistence & Privilege
- okalways is false and the skill is user-invocable. It does not request persistent presence or system configuration changes.