Back to skill
Skillv1.0.2
ClawScan security
Data Privacy Checklist · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 16, 2026, 3:09 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose — it is an instruction-only wrapper that collects yes/no answers and forwards them to ToolWeb's API using an API key — but it will transmit potentially sensitive organisational assessment data to a third‑party endpoint, so verify the provider before use.
- Guidance
- This skill will send your answers (organization-level privacy posture and notes) to ToolWeb's API and requires you to provide an API key. Before installing or enabling it: (1) Verify the provider (portal.toolweb.in) is trustworthy and review their privacy/security and retention policies; (2) Limit the API key's privileges if possible and store it separately from sensitive secrets; (3) Test with non‑sensitive/sample data to confirm what the API returns and whether any personally identifiable data is transmitted; (4) Confirm TLS (HTTPS) use and check network logs to ensure headers/keys are not leaked to other endpoints; (5) If you require offline/local assessments or must keep assessments in-house, do not rely on this skill because SKILL.md forbids local generation of results. If you can provide proof of the provider's data handling (privacy policy, SOC/ISO reports, or a support contact), that would increase confidence.
Review Dimensions
- Purpose & Capability
- okName/description (data privacy checklist / scoring) align with the declared requirements: a single service API key (TOOLWEB_API_KEY) and curl to call portal.toolweb.in. Requiring an API and key is coherent because scoring is performed by ToolWeb's proprietary algorithms.
- Instruction Scope
- noteSKILL.md directs the agent to gather user answers and ALWAYS POST them to https://portal.toolweb.in/apis/compliance/data-privacy-checklist and never generate assessments locally. That is consistent with the claimed design, but it means all user-provided assessment inputs (potentially sensitive internal compliance details) are sent to the third party and tracked for billing. There are no instructions to read unrelated files or env vars.
- Install Mechanism
- okInstruction-only skill with no install spec or code files. This is low risk from an installation perspective — nothing is written to disk by the skill itself.
- Credentials
- okOnly one env var (TOOLWEB_API_KEY) is required and is used as the X-API-Key header in the curl request. This is proportionate to calling a hosted scoring API. No unrelated credentials or system config paths are requested.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide config changes or other skills' credentials. Model invocation is allowed (platform default) but that is not combined with elevated privileges here.