Back to skill
Skillv1.0.0
ClawScan security
Paper to Tools - Match Research Methods to AI Agents · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 9, 2026, 3:32 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it is an instruction-only mapping tool that extracts methodology keywords and returns links/install hints for curated science agents, and it does not request credentials, installs, or elevated privileges.
- Guidance
- This skill appears low-risk and coherent: it is a local mapping/information helper that returns links and install hints for other science agents. Before installing or following its recommendations you should (1) review any linked agents individually—those agents may request credentials, external installs, or access to data you should protect (especially clinical/PHI data); (2) avoid pasting sensitive or private data (patient information, proprietary methods) into the skill unless you are sure the target agent and your environment are appropriate; and (3) verify links (claw4science.org and GitHub pages) and the install commands for any third-party tools before running them. If you want additional assurance, ask the skill author for provenance of the mapping table or for an auditable source for the 131+ agents.
Review Dimensions
- Purpose & Capability
- okName/description match the runtime instructions: the SKILL.md describes extracting methodology keywords and mapping them to a static table of science agents. The skill declares no binaries, env vars, or installs, which is appropriate for a purely informational mapping skill.
- Instruction Scope
- okRuntime instructions are scoped to extracting keywords from user-pasted text, matching them to the provided mapping table, ranking results, and returning agent links and installation hints. The instructions do not direct reading of system files, access to environment variables, or transmitting data to unexpected endpoints. They do recommend 'npx skills add' or linking to GitHub for installation of other agents (which is a valid, limited action to suggest).
- Install Mechanism
- okNo install spec or code files are present; the skill is instruction-only and therefore does not install anything itself. This is the lowest-risk model and matches the skill's purpose.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. Nothing in the SKILL.md attempts to access secrets or unrelated services.
- Persistence & Privilege
- okalways is false and the skill does not request persistent presence or modify agent/system configs. The default ability for agents to invoke the skill autonomously remains, which is expected and appropriate for a lookup/mapping skill.