Skillv1.0.0

ClawScan security

Telegram Phone Checker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 22, 2026, 2:37 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions align with its stated purpose (checking Telegram registration via apipick) and there are no disproportionate installs, credentials, or unexpected behaviors.
Guidance: This skill will send phone numbers you provide to apipick.com and requires your APIPICK_API_KEY. Only install/use it if you trust apipick and are comfortable sharing phone numbers with that service. Be aware each lookup costs credits on your apipick account. Prefer setting the API key as an environment variable rather than pasting it into chat, and review apipick's terms/privacy policy if you plan to check personal or third‑party numbers. Ensure your use complies with privacy laws and platform terms before bulk or automated queries.

Purpose & Capability: okName/description match the declared requirement (APIPICK_API_KEY) and the SKILL.md references only the apipick API endpoint (https://www.apipick.com/api/check-phone-telegram). No unrelated services, binaries, or credentials are requested.
Instruction Scope: okRuntime instructions are narrow: build a POST request with phone_number, include x-api-key from $APIPICK_API_KEY (or ask user if not set), validate country code format, and report results. They do not instruct reading other files, system state, or sending data to unexpected endpoints.
Install Mechanism: okInstruction-only skill with no install spec and no code files. Nothing is downloaded or written to disk by the package itself.
Credentials: okOnly a single API key (APIPICK_API_KEY) is required and that matches the declared primaryEnv. No other secrets, tokens, or config paths are requested.
Persistence & Privilege: okNo elevated persistence requested (always is false). The skill does not request to modify other skills or system-wide settings.