Skillv0.1.0

ClawScan security

Ai Traffic Tracking · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 11, 2026, 11:32 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only GA4/GSC guidance skill whose requested actions, lack of installs, and lack of credential requirements align with its stated purpose.
Guidance: This skill is a guidance document for configuring GA4/GSC and appears internally consistent. Before applying changes in a production property, test the regex and channel-group rules in a staging or test view to avoid misclassifying traffic; validate the regex against your actual Session Source values (it may need additions/removals). Note that although this skill itself asks for no credentials, actually implementing the steps requires GA4/GSC access — grant only the minimum necessary permissions and review related skills (e.g., google-search-console) before installing or combining them, since those may require OAuth/API credentials.

Purpose & Capability: okThe name/description (AI traffic tracking for GA4 and GSC) align with the runtime instructions, which are GA4 exploration/channel-group/custom-report steps and regexes for common AI referrers. The skill does not request unrelated credentials or binaries.
Instruction Scope: okSKILL.md contains only step-by-step instructions for creating GA4 reports, channel groups, and filtersplus a recommended regex. It does not instruct reading local files, accessing environment variables, or sending data to external endpoints outside the analytics tools it documents.
Install Mechanism: okNo install spec and no code files — instruction-only. Nothing will be written to disk or downloaded by the skill itself.
Credentials: okThe skill requires no environment variables or credentials. That is proportionate: to implement the guidance a user would need GA4/GSC admin access, but the skill itself does not request those credentials.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request persistent system presence or modify other skills' configurations.