Skillv0.1.0

ClawScan security

Mvp Planning · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 18, 2026, 6:20 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only MVP planning playbook whose requirements and instructions are consistent with its stated purpose and do not request system access, installs, or credentials.
Guidance: This skill is a text-only MVP planning playbook and appears low-risk: it doesn't install software or ask for credentials. Before installing, review the full SKILL.md to confirm it fits your workflow. Be mindful that when you use the skill you may provide business-sensitive details (ideas, metrics, customer lists) to the agent — avoid pasting secrets or credentials. Because the skill's source and homepage are not listed, prefer installing skills from known authors or marketplaces when possible, and treat the advice as guidance to be validated against your own judgment and domain expertise.

Purpose & Capability: okThe skill name and description (MVP planning for solopreneurs) match the SKILL.md content: a step-by-step playbook for scoping, cutting features, launch criteria, and build-vs-buy decisions. There are no unrelated requirements (no env vars, no binaries, no config paths).
Instruction Scope: okSKILL.md contains purely advisory text and templates for planning an MVP. It does not instruct the agent to read local files, environment variables, or contact external endpoints, nor does it direct collection/transmission of data beyond asking the user for product context as part of the normal advice flow.
Install Mechanism: okNo install spec or code files are present; this is an instruction-only skill, so nothing is written to disk and no third-party packages are fetched.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. The playbook's needs (user-provided product context, goals, feature list) are proportional to its purpose.
Persistence & Privilege: okThe skill does not request always:true and uses default invocation settings. There is no indication it modifies other skills or system-wide settings.