Back to skill
Skillv0.1.0
ClawScan security
Business Plan · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 9:07 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only skill that clearly describes how to write and update a solopreneur business plan; it requests no credentials, installs, or unusual access and is internally consistent with its stated purpose.
- Guidance
- This skill is instruction-only and coherent with its stated purpose, and it does not ask for credentials or installs. Before using it, consider: (1) the skill references outputs from other skills — verify those companion skills are trustworthy and not exposing PII or confidential financials; (2) do not paste bank account numbers, passwords, or other secrets into prompts used to generate plans; (3) the skill metadata lists an unknown source and no homepage — if you plan to rely on it for investor materials, prefer skills from identifiable/maintained sources or review the generated content carefully; (4) review any investor-facing plan before sharing to redact sensitive customer or vendor information. If you want higher assurance, ask the skill owner for provenance or prefer an equivalent tool from a known publisher.
Review Dimensions
- Purpose & Capability
- okThe name, description, and SKILL.md all align: the skill is a playbook for drafting and updating a business plan. It does not request binaries, env vars, config paths, or installs that would be unrelated to that purpose.
- Instruction Scope
- noteThe SKILL.md stays within the expected scope of creating a business plan. It explicitly tells the agent to 'pull directly from your market-research skill output' and other companion skills (competitive-analysis, business-model-canvas, positioning-strategy). That is reasonable in a composable skill ecosystem, but it means the plan may aggregate outputs from other skills — review those skills for what data they expose (they could contain PII or sensitive customer quotes). The instructions do not tell the agent to read system files, environment variables, or send data to unexpected external endpoints.
- Install Mechanism
- okNo install spec or code files are present; this is instruction-only, which minimises disk writes and arbitrary code execution risk.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. Nothing requested appears disproportionate to generating a business plan. Note: the content could still include or summarize sensitive data if the user or connected skills supply it.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-level changes or cross-skill configuration. Model invocation is allowed (default) which is normal for an agent-invokable skill.