Back to skill
Skillv0.8.1
ClawScan security
aimpact · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 20, 2026, 7:15 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions match its stated purpose (fetching and formatting AI news), it only needs curl and the bundled source/format files, and it doesn't request unrelated credentials or install arbitrary code.
- Guidance
- This skill appears coherent and low-risk: it will make network requests (requires curl) to the documented agent.me.news API endpoints and format results per the included template. Before installing: (1) confirm you trust the agent.me.news endpoints in sources.md, (2) ensure your OpenClaw message channels/credentials (if you enable push) are already configured and limited to the intended targets, and (3) if you schedule automated runs (cron/Task Scheduler), verify the scheduled commands and review any pushed content to avoid accidental disclosure. If you need higher assurance, ask the publisher for a provenance URL or an official homepage so you can vet the upstream service.
Review Dimensions
- Purpose & Capability
- okName/description (AI news briefs and rankings) align with what the skill asks for: curl-based API calls to a fixed set of news endpoints, local sources.md/format.md for configuration and output shape, and optional use of an already-configured message tool for push. No unrelated binaries or credentials are requested.
- Instruction Scope
- okSKILL.md explicitly limits actions to reading the included sources.md and format.md, calling only the whitelist API endpoints (via curl, with web_fetch fallback), extracting a small set of fields, de-duplicating, sorting, formatting, and optionally pushing via the message tool. It does not instruct reading arbitrary system files, environment secrets, or sending data to unknown endpoints.
- Install Mechanism
- okThis is instruction-only with no install spec and no code files to write or execute. Required binary is curl (reasonable for API fetches). No downloads, archives, or external installers are used.
- Credentials
- okNo environment variables, credentials, or config paths are required by the skill. It notes optional use of the platform's message tool and expects any channel credentials to be pre-configured by the user in OpenClaw (it does not request or store them).
- Persistence & Privilege
- okalways is false and the skill does not request any elevated or persistent system-wide presence. It does not modify other skills' configs or require storing credentials. Optional cron scheduling examples are user-side instructions, not automatic persistence.