Back to skill
Skillv1.0.0
ClawScan security
SABSA Architecture · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 29, 2026, 12:02 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- This is an instruction-only API specification for a SABSA assessment tool that requests no credentials or installs and is internally consistent, but it is incomplete (no implementation or host) so you should confirm how/where data will be processed before sending real information.
- Guidance
- This skill is essentially documentation (an OpenAPI spec + usage examples) rather than a runnable service. Before using it with real organizational data: 1) Ask the publisher where the service runs and how data is transmitted/stored (no host or privacy/retention info is provided). 2) Do not send sensitive or production data until you confirm the endpoint, TLS, and data handling policies. 3) If you expect a hosted API, require a concrete base URL and an operator/owner; if you expect to self-host, request the implementation/source code and run it in an isolated environment for review. 4) The skill itself asks for no credentials, but any integration you add later might—only provide secrets to trusted, documented endpoints.
Review Dimensions
- Purpose & Capability
- okThe name and description promise a SABSA security architecture assessment and the files (SKILL.md + openapi.json) provide request/response schemas and endpoints consistent with that purpose. The skill does not request unrelated binaries, credentials, or system access, which aligns with an instruction-only API specification.
- Instruction Scope
- noteThe SKILL.md describes endpoints, sample requests/responses, and schemas but does not provide a server host/URL, runtime implementation, or instructions that read system files or environment variables. It is scoped to describing the API and expected payloads, but it is incomplete for runtime use — the agent or integrator must supply where/how to call the API or implement the service. No instructions appear to exfiltrate data or access unrelated system state.
- Install Mechanism
- okThere is no install specification and no code files to execute; this is the lowest-risk model (instruction-only). Nothing is written to disk or downloaded by the skill itself.
- Credentials
- okNo environment variables, credentials, or config paths are requested. That is proportional for an API-specification-only skill that makes no claims of integrating with cloud providers or third-party services.
- Persistence & Privilege
- okalways is false and there is no indication the skill requests persistent privileges or modifies other skills or system-wide configuration. Autonomous invocation remains possible (platform default) but is not combined with other concerning privileges.