Back to skill
Skillv1.0.0
ClawScan security
Changelog Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 1:08 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with a changelog generator: it runs local git commands to build a changelog and has no networking, secrets, or unusual installs, though the package metadata omitted the expected dependency on the git binary.
- Guidance
- This skill appears to do what it claims: it runs git locally to build changelogs and can write the result to a file. Before using it: ensure the machine has git and Python installed (the metadata should have declared git but did not), verify you point it to the intended repository path, and review commit messages if they contain sensitive information (commit history may include secrets). Because it executes git in the repo, run it in a trusted environment and confirm the script is acceptable to you before granting an agent autonomous permission to invoke it.
Review Dimensions
- Purpose & Capability
- noteName/description match the included script: the tool parses conventional commits from a local git repo and formats markdown/JSON changelogs. One minor inconsistency: the skill metadata lists no required binaries, but the script invokes the system 'git' command — git is a legitimate and necessary dependency for this purpose and should be declared.
- Instruction Scope
- okSKILL.md and the script instruct the agent to run the included Python script against a specified repo. The script only runs git commands (git log, rev-parse) against the repo and writes output to stdout or a user-specified file. It does not read arbitrary unrelated system files, access environment variables, or transmit data externally.
- Install Mechanism
- okThis is an instruction-only skill with a bundled script; there is no install spec, no downloads, and nothing is written to disk by an installer. The runtime requires Python and the git binary, but no install mechanism is provided (which is acceptable for an instruction-only skill).
- Credentials
- noteThe skill requests no environment variables or credentials. It does require access to a local git repository and the git CLI; those are proportionate to its stated function. The omission of 'git' from declared required binaries is the only discrepancy.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated or persistent privileges. It can write an output file only when the user supplies a path (or runs it in a writable directory), which is expected behavior for a changelog generator.