Back to skill
Skillv1.0.0
ClawScan security
Legal Client Intake Interview Builder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 26, 2026, 12:24 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only, descriptive skill that aligns with its stated purpose (creating legal intake checklists/templates), does not request credentials, install software, or instruct network or file access, and is internally consistent with its documentation.
- Guidance
- This package appears internally consistent and descriptive-only, but consider the following before installing or using it in production: (1) Provenance — the source/homepage is unknown; verify authorship or trustworthiness if that matters to your organization. (2) Confidential data — do not paste privileged or client-identifying information into the skill or chat without confirming your data-handling policies; the skill itself does not request credentials but the agent runtime will see any user-provided content. (3) Legal risk — outputs are informational workflow aids only and not legal advice; always have a licensed attorney verify jurisdictional rules, deadlines, privilege/ethics issues, and final substantive recommendations. (4) Quick sanity check — the package contains only SKILL.md, README.md, ACCEPTANCE.md, and skill.json as advertised; if you later see additional files (scripts, handler.py, binaries, or network calls), treat that as a red flag and revoke use.
Review Dimensions
- Purpose & Capability
- okThe name and description (legal intake interview builder) match the SKILL.md and README: the package is purely descriptive, produces checklists/templates, and does not declare or require unrelated resources (no env vars, no binaries, no APIs).
- Instruction Scope
- okSKILL.md restricts operation to producing frameworks, templates, and checklists and explicitly states it will not execute code, call external APIs, access databases, or perform filings. It does not instruct reading arbitrary system files, environment variables, or transmitting data to external endpoints.
- Install Mechanism
- okThere is no install specification and no code files. Being instruction-only means nothing is written to disk or downloaded during install — the lowest-risk class of package.
- Credentials
- okThe package declares no required environment variables, credentials, or config paths. That is proportionate for a document-only skill that generates interview plans.
- Persistence & Privilege
- okThe skill is not forced-always (always:false). It permits autonomous invocation (disable-model-invocation:false), which is the platform default and acceptable here because the skill does not request elevated access or persistent credentials.