Skillv2.9.1

ClawScan security

Roundtable Adaptive · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignFeb 26, 2026, 11:09 PM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions are generally consistent with a multi-model roundtable orchestrator, but there are a few minor documentation mismatches and external-service assumptions you should check before installing.
Guidance: This skill appears to do what it says, but check these before installing: 1) The skill requires an Anthropic API key for the Claude panel — only provide it if you trust the skill and understand provider billing. 2) Full multi-model operation is optional: OpenAI and Blockrun integrations are supported but require extra credentials/config (OPENAI_API_KEY, BLOCKRUN_PROXY_URL) and, for Blockrun, installing a plugin and funding a wallet — expect small per-run costs if you enable them. 3) The skill will post to Discord channels/threads and needs permission to list/create threads and post messages; set the output channel intentionally (ROUNDTABLE_OUTPUT_CHANNEL/panels.json). 4) Results and logs are written to your workspace memory directory ({workspace}/memory/roundtables or ~/clawd/memory/roundtables) — if you need to prevent local persistence, do not enable the skill or modify the paths. 5) The package source/homepage is missing and the registry lists an owner ID but no homepage — if provenance matters, ask the publisher for a source repo or audit the files. 6) If you won't use Blockrun/OpenAI features, you can run in Claude-only degraded mode; otherwise, verify you trust any third-party proxies (Blockrun) before pointing local services at them. If you want greater assurance, request the source repo or a signed release and check the exact message/action APIs the agent will call in your environment.

Review Dimensions

Purpose & Capability: okThe declared requirement (ANTHROPIC_API_KEY and providers.anthropic) fits the primary purpose (Claude-based roundtables). The skill is instruction-only and orchestrates multiple models (optional OpenAI/Blockrun slots) which matches the description and panel configs. The disk writes (workspace memory/roundtables) and Discord messaging are expected for an orchestration/orchestration+UI skill.
Instruction Scope: noteSKILL.md instructs the agent to perform web searches, list/create Discord threads (message actions), spawn persistent session agents, run cross-critique rounds, and save outputs to local workspace memory. Those actions are within the skill's stated purpose, but they do involve network calls (web search, model providers) and writing structured files to disk. Also: it refers to an output channel variable (ROUNDTABLE_OUTPUT_CHANNEL) and automatic channel auto-trigger behavior — users should confirm these posting behaviors and needed messaging permissions.
Install Mechanism: okThere is no install spec; the skill is instruction-only (lowest install risk). It does recommend optionally installing a Blockrun OpenClaw plugin and running a local Blockrun gateway (and funding a wallet) for additional providers; that advice is external to the skill and not automatically executed by it.
Credentials: noteThe registry only requires ANTHROPIC_API_KEY and providers.anthropic config, which is proportionate. However the SKILL.md and panels.json reference optional items not declared as required env vars/config in the registry: OPENAI_API_KEY, BLOCKRUN_PROXY_URL (default http://localhost:8402), and a ROUNDTABLE_OUTPUT_CHANNEL config. Those are optional but referenced frequently; users should be aware additional credentials/configs will be needed for the full experience and that Blockrun usage may require local proxy access and on-chain wallet funding.
Persistence & Privilege: okalways:false (normal). The skill's runtime spawns persistent panel sessions in Discord threads (expected for multi-round interaction), but it does not request always-enabled privilege or claim to modify other skills' configs. It writes its own results/state to a workspace memory directory (normal for this type of skill).