Skillv1.0.4

ClawScan security

Cn To En Listing Writer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 21, 2026, 8:57 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requirements and runtime instructions match its stated purpose (rewriting Chinese product info into Amazon-ready English listings); it is an instruction-only skill with no unexpected env vars, installs, or file access.
Guidance: This skill appears coherent and low-risk because it is instruction-only and requests no credentials. Before using it: do not paste highly sensitive supplier agreements or private data if you want them kept confidential; carefully verify any factual claims (measurements, certifications, warranty wording) the generator inserts—AI can hallucinate or overstate compliance; review produced listings for Amazon policy and legal compliance (safety claims, restricted product wording); and edit keyword/back-end fields to match your own SEO strategy. If you need automated bulk processing or live web research, confirm whether the agent will perform external network calls (the SKILL.md does not require them).

Purpose & Capability: okName, description, and SKILL.md consistently describe generating 3 Amazon-optimized English listing variations from Chinese product input. The skill requests no credentials, binaries, or config paths that would be unrelated to this purpose.
Instruction Scope: okThe instructions are limited to parsing input, interpreting attributes, producing three listing variations, and running internal compliance checks. They do not instruct reading system files, accessing environment variables, or sending data to external endpoints. The 'research the category context' step is described as 'based on trained knowledge' and does not mandate web scraping or external API calls.
Install Mechanism: okNo install spec or code files — instruction-only. Nothing will be written to disk or downloaded during install.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. There are no disproportionate secret or credential requests.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request persistent/system-wide privileges or modify other skills' configs.