Skillv1.0.0

ClawScan security

Crypto Alert Aggregator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

ReviewApr 19, 2026, 2:57 AM

Verdict: Review
Confidence: medium
Model: gpt-5-mini
Summary: The skill mostly matches its stated purpose but contains several inconsistencies (missing declared env vars, owner mismatch, and the code never actually uses external APIs or the webhook) that make its behavior unclear and warrant caution.
Guidance: This package appears to be a stubbed crypto/Twitter aggregator: its docs ask for API keys and a webhook, but the shipped code only returns mocked data and does not call any external APIs or use the webhook. Also, the registry metadata and _meta.json owner IDs do not match, and required env vars are not declared in the registry. Before installing or providing any API keys: 1) verify the author's identity and a trusted source/URL for the package; 2) ask the author or maintainer for a version that implements real API calls (and for a clear explanation of when and where data would be sent); 3) check that any webhook forwarding is explicit and auditable; 4) avoid supplying production API keys until the code has been audited and a clear privacy/usage policy is provided. If you expected a working integration, treat this as untrusted/unfinished code rather than a ready-to-run skill.

Review Dimensions

Purpose & Capability: noteName/description (crypto + Twitter signals) align with the code's intent. The SKILL.md asks for CRYPTO_API_KEY, TWITTER_API_KEY, and ALERT_WEBHOOK which are reasonable for this purpose. However, the registry metadata claims no required environment variables or primary credential, and the included code never actually makes real API calls (it always returns mocked data). This mismatch between declared requirements and the runtime behavior is unexpected.
Instruction Scope: concernSKILL.md instructs consumers to set API keys and an optional webhook. The index.js reads those environment variables into config, but its network-call functions contain 'Placeholder for actual API call' comments and always return mock data regardless of whether keys are present. The ALERT_WEBHOOK is present in config but never used. This is misleading: the instructions promise external integration and alert forwarding, but the implementation currently does not perform either.
Install Mechanism: okThere is no install spec (instruction-only style plus a small JS file). Nothing is downloaded or written to disk by an install step. This is low risk from an installer perspective.
Credentials: concernSKILL.md requests API keys and a webhook (sensible for the stated function), but the skill registry metadata does not declare any required env vars or a primary credential. The code reads the env vars but does not act on them (mocking instead). Because the manifest doesn't declare these required secrets and the code doesn't use them, there's ambiguity about whether you'll need to supply credentials and whether those keys would ever be transmitted. The presence of an ALERT_WEBHOOK setting is worth noting because if implemented later it could send data externally.
Persistence & Privilege: okThe skill is not always-enabled and does not request elevated privileges. It starts a setInterval-based poller when streamAlerts is used, which is expected for a streaming alerts module. It does not modify other skills or system-wide settings.