Skillv1.0.0

ClawScan security

热梗百科 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 12, 2026, 7:53 AM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's files, instructions, and installer are consistent with a meme-collection / research assistant; it doesn't request credentials or download remote code during install, but it relies on network searches at runtime and includes local scripts you may want to inspect before use.
Guidance: What this means for you: the skill appears coherent with its stated goal and does not ask for secrets or download remote code at install. It does, however, rely on network access to search public sites and will collect links/metadata; if you install it the agent may crawl public pages to build the encyclopedia. Before installing: (1) inspect scripts (scripts/meme_collector.py and install.sh) yourself or in a sandbox to confirm there are no unexpected network calls or telemetry (the provided Python appears local-only, but scanning the full file is prudent); (2) run install.sh in a non-production environment to verify behavior; (3) be aware of copyright/privacy when collecting or reusing video content; (4) if you plan to extend it to use platform APIs, only provide API keys you trust and verify why they are needed. If you want extra caution, run the skill inside an isolated user account or container and monitor network activity while it runs.

Review Dimensions

Purpose & Capability: okName/description (collecting and explaining trending memes from B站/抖音/etc.) match the included assets: SKILL.md, templates, references, a helper Python script, and an installer that places the skill in a Claude-like skills directory. No unrelated credentials, binaries, or system paths are requested.
Instruction Scope: noteSKILL.md instructs the agent to search platform hotlists, gather video metadata, trace sources, and assemble an encyclopedia — all appropriate for the described purpose. It requires network access which is explicit in the compatibility note. The instructions are somewhat broad (search keywords, judgment about source validity), so at runtime the agent will perform open-ended web searches/scraping across public platforms; that is expected for this use case but does give the agent wide latitude to fetch arbitrary web content.
Install Mechanism: okThere is no remote download/install step. install.sh copies the local skill directory into candidate skills directories (~/.claude/skills etc.), sets permissions, and runs a small local python frontmatter check. The script does not fetch code from external URLs and does not modify other skills or global system files beyond creating/using the target skills directory.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. The install script mentions a CLAUDE_SKILLS_PATH example but doesn't require secrets. The runtime behavior (searching public pages and collecting links/metadata) doesn't need credentials unless you later add API-backed features — which would need to be declared.
Persistence & Privilege: okalways is false and the installer only copies files into a user-level skills directory. The skill does not request permanent elevated privileges nor attempt to change other skills' configurations. Installer shows an uninstall command (rm -rf) enabling removal.