Back to skill
Skillv1.0.0
ClawScan security
recruitment-assistant · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 5, 2026, 11:04 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requested access and instructions are consistent with a local resume‑screening assistant: it only reads job folders and resumes, requires no external credentials or installs, and does not ask to transmit data externally.
- Guidance
- This skill appears coherent and focused on local resume processing, but review these before installing: 1) Confirm how your agent runtime grants filesystem access — the skill will read resumes (including contact info) in the specified jobs/ folders, so only grant access to intended directories. 2) Verify that PDF/DOC/DOCX parsing will run locally and not call external services (the skill doesn't declare how parsing is implemented). 3) Treat resumes as sensitive personal data; test with non-sensitive samples first and confirm generated reports stay local. 4) personalprefer.txt is global to jobs/ and influences all positions — keep per-interviewer preferences private if needed. 5) If your environment has network access, audit agent/network policies to ensure no unintended uploads of candidate data. If you need more assurance, request an explicit implementation that documents the parser libraries used and a proof that no network calls are made during processing.
Review Dimensions
- Purpose & Capability
- okName/description (resume screening, report and interview question generation) matches the instructions and the files included. There are no unexpected environment variables, credentials, or unrelated binaries requested.
- Instruction Scope
- noteSKILL.md explicitly directs the agent to read JD.txt, resumes (PDF/DOC/DOCX/HTML/TXT) and an optional global personalprefer.txt, then generate local HTML/Markdown reports. This is within stated purpose. Note: the skill will extract contact details and other personal data from resumes (expected for this purpose) and claims processing is local — the repository contains no steps that send data to external endpoints, but the skill does not describe how PDF/DOCX parsing is implemented (so behavior depends on the runtime environment).
- Install Mechanism
- okInstruction-only skill with no install spec and no code files; nothing is downloaded or written by the skill itself. This is the lowest-risk install model. However, extracting text from PDFs/DOCX may require parser libraries/tools that are not declared here — the skill assumes the agent environment can parse these formats.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The requested scope (reading a local jobs/ folder and an optional personalprefer.txt) is proportionate to the described functionality.
- Persistence & Privilege
- okSkill is not always-on and does not request elevated privileges or system-wide configuration changes. It does not declare modifications to other skills or global agent settings.