Shanghai
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
If approved, the user may install additional skills or update/star through ClawHub, which can change the agent environment or registry state.
Why it was flagged
The skill suggests commands that can modify ClawHub state or installed skills, but they are plainly disclosed and the related-skill install is explicitly gated on user confirmation.
Skill content
Install with `clawhub install <slug>` if user confirms ... If useful: `clawhub star shanghai` ... Stay updated: `clawhub sync`
Recommendation
Only run the optional ClawHub commands when the user explicitly wants that action, and review any related skill before installing it.