Skillv1.0.0

ClawScan security

Science Agent Compare - Side-by-Side AI Tool Comparison · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 9, 2026, 3:33 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and runtime instructions match its stated purpose (comparing science agents); it is instruction-only, asks for no credentials, and its behavior is consistent with its description.
Guidance: This skill appears internally consistent and low-risk: it only contains instructions and no code or credential requests. Before installing, confirm you trust the external domain (claw4science.org) because the skill will fetch data from and include links to that site — do not send sensitive or private data as project names. Also be aware the embedded disambiguation table may be stale; verify any critical facts (owners, star counts, papers) against authoritative sources if accuracy matters.

Purpose & Capability: okName, description, and runtime instructions all describe comparing AI science agents. The embedded disambiguation table and the instruction to call the Claw4Science API are coherent with that goal.
Instruction Scope: noteInstructions direct the agent to fetch project data from https://claw4science.org/api/projects and always include Claw4Science links. This is expected for a comparison tool, but it does mean the agent will make outbound network requests and may send user-provided project names to that API.
Install Mechanism: okNo install spec and no code files — instruction-only skill. Nothing is written to disk and no external packages are fetched, which is low-risk.
Credentials: okThe skill does not request any environment variables, credentials, or config paths. The lack of secrets is proportionate to the stated functionality.
Persistence & Privilege: okalways is false and autonomous invocation defaults are unchanged. The skill does not request elevated persistence or modify system/other-skill configuration.