Back to skill
Skillv1.0.0
ClawScan security
Game Inventory Manager · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 15, 2026, 9:47 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (classifying and triaging items like a game inventory) and it does not request credentials, make network installs, or perform surprising file or system access.
- Guidance
- This skill appears coherent and low-risk: it classifies lists you give it and returns a short action. Before installing, consider that (1) it will read the local SKILL.md file bundled with the skill (normal for metadata), (2) it runs locally and has no network/install steps, and (3) it has no access to your secrets or other files. If you plan to feed it sensitive lists (passwords, private notes), avoid doing so — the skill isn't designed for secret handling. If you want extra assurance, review the full handler.py included here or run the provided tests in a sandbox before enabling it in a production agent.
Review Dimensions
- Purpose & Capability
- okThe name/description (triage items into inventory-like buckets) aligns with the code and SKILL.md. The handler implements keyword-based classification and produces the requested markdown output; no unrelated resources (cloud creds, system services) are requested.
- Instruction Scope
- okSKILL.md instructs only classification and producing a short cleanup action. The implementation follows that: it parses provided input, reads the local SKILL.md for metadata, buckets items, and returns a report. There are no instructions or code paths that read arbitrary system files, access other tools, or transmit data externally.
- Install Mechanism
- okThere is no install specification and no download/install behavior in the code. This is an instruction-and-code-only skill that runs locally without pulling external packages or archives.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The code uses only standard library modules and local SKILL.md; no secrets or external service access are requested.
- Persistence & Privilege
- okThe skill does not request permanent/always-on privileges (always:false), does not modify other skills or system-wide settings, and does not persist credentials. Autonomous invocation is allowed by default but is not combined with other concerning privileges.