Back to skill
Skillv1.0.0
ClawScan security
Parallax · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 3, 2026, 8:02 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- Parallax is an instruction-only decision-analysis helper whose declared requirements match its stated purpose; nothing in the visible instructions asks for secrets or system access, but the SKILL.md content was partially truncated so you should verify the full text before installing.
- Guidance
- This skill appears coherent and low-risk because it is instruction-only and declares no credentials or installs. Before installing, open and read the full SKILL.md (the provided excerpt was truncated) to confirm it does not: (1) instruct the agent to read system files or shell history, (2) request or reference environment variables or secret tokens, or (3) direct data to external endpoints. If you plan to let agents call skills autonomously, restrict which tools the agent can use (file access, shell, network) or run it in a sandboxed environment so the skill cannot access secrets or external systems without your explicit approval.
Review Dimensions
- Purpose & Capability
- okName and description describe a decision-intelligence aid; the skill is instruction-only with no required binaries, env vars, or config paths, which is proportionate and expected for this purpose.
- Instruction Scope
- noteThe visible SKILL.md contains step-by-step analytic guidance for five stakeholder lenses and operates on an input 'proposed change' — it does not, in the shown portion, instruct the agent to read files, environment variables, or send data to external endpoints. However the provided snippet is truncated, so the full instruction file should be reviewed to ensure there are no hidden steps that request system state, credentials, or network exfiltration.
- Install Mechanism
- okNo install specification and no code files — lowest-risk setup; nothing will be written to disk or externally downloaded by the skill itself.
- Credentials
- okThe skill declares no required environment variables, no primary credential, and no config paths; these are appropriate for a purely advisory/instructional skill.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; model invocation is allowed (the platform default). There is no indication the skill requests persistent installation or modifications to other skills.