v1.0.0

IOT Developer

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 8:34 AM.

Analysis

The skill appears to be a purpose-aligned IoT career-roadmap API, with the main thing to notice being that it may send career assessment details and optional tracking identifiers to the service.

GuidanceThis looks safe for its stated purpose, but treat the assessment as personal information: share only what is needed, avoid unnecessary identifiers, and verify that you trust the publisher before using it.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agentic Supply Chain Vulnerabilities

SeverityInfoConfidenceHighStatusNote

metadata

Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill.

There are no install-time actions or code files, which lowers execution risk, but the artifacts do not provide an independent source or homepage for provenance review.

User impactYou have limited public information about who operates or maintains the service behind the skill.

RecommendationInstall only if you trust the publisher, and avoid sharing more personal information than necessary.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

`POST /api/iot/roadmap` with `userId`, `sessionId`, and `assessmentData` containing `experience`, `skills`, and `goals`; `userId` is described as a "User identifier for tracking and analytics".

The main workflow sends personal career and skills assessment information, plus an optional tracking identifier, to an API. This is aligned with generating a personalized roadmap, but it is still privacy-relevant.

User impactYour professional background, skills, goals, and a tracking identifier could be shared with the service when generating a roadmap.

RecommendationProvide only the information needed for the roadmap, omit or null the userId when possible, and review any available privacy terms before sharing sensitive career details.