Back to skill
Skillv1.0.0
ClawScan security
Apple News (MacOS) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 6, 2026, 7:41 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions align with its stated purpose (opening and automating Apple News on macOS); it is an instruction-only skill that stores small local state and uses only macOS-native commands and user-owned Shortcuts.
- Guidance
- This skill appears coherent and limited to its stated purpose, but check a few things before installing: 1) The skill will create and update files under ~/apple-news/ — review and approve those writes when prompted if you want to keep no local traces. 2) If you enable Shortcut-based searches, review the exact Shortcuts you let the skill run — Shortcuts can call external services or perform actions beyond opening News. 3) AppleScript/Accessibility prompts may appear if a fallback needs UI scripting; grant those only if you trust the action. 4) The skill opens apple.news links in News.app; verify you want those links opened and confirm bulk-open prompts when presented. If you want lower risk, avoid enabling Shortcut-based automation and keep the confirmation defaults enabled.
Review Dimensions
- Purpose & Capability
- okName/description match the actual behavior: the skill only requires macOS-native utilities (open, osascript, shortcuts) and a local config path for memory and logs to support deterministic News.app operations. No unrelated credentials or services are requested.
- Instruction Scope
- noteInstructions limit actions to launching News.app, opening validated https://apple.news links, probing command availability, and running user-owned Shortcuts. One notable scope consideration: running a user-owned Shortcut may cause arbitrary network activity or side effects defined in that Shortcut (the skill documents this and asks for explicit confirmation). The skill also writes small local files under ~/apple-news/ (memory and logs) after asking for confirmation.
- Install Mechanism
- okNo install spec or remote downloads are present — instruction-only skill. This minimizes disk-write and supply-chain risk.
- Credentials
- okNo environment variables or external credentials are required. The only filesystem access declared is ~/apple-news/, which is proportionate for storing preferences, logs, and command probes.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; it stores its own small local state in a dedicated folder and does not request system-wide or other-skills configuration changes.