Back to skill
Skillv1.0.0
ClawScan security
Freelance Job Scraper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousMar 27, 2026, 9:32 PM
- Verdict
- suspicious
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill mostly does what it says for Hacker News (via the gh CLI) but overpromises (claims multiple boards) while the code only implements HN and contains logic bugs and small risks that make it inconsistent with its description.
- Guidance
- This skill is partially implemented and overpromises: it claims to monitor HN, YC, and remote job boards but the included script only queries Hacker News via the gh CLI. Before installing or running it: 1) Inspect the script locally (you already have it) — it only uses the gh CLI and prints results. 2) Be aware gh runs using your GitHub auth (ensure the token has minimal scopes you are comfortable with). 3) The script has bugs: it assumes reply_count is 0 (so it always awards 'low competition' points), and when you pass --output it actually writes an empty file because it never captures the printed report into a string. 4) If you expect YC or remote board scraping, do not rely on this package — those features are not implemented. 5) Run it in a disposable environment or inspect/patch the script to fix/report-capture and to implement or remove advertised sources before trusting production use.
Review Dimensions
- Purpose & Capability
- concernThe README/description promises scraping HN, YC jobs, and remote aggregators, but the included code (scripts/scan_jobs.py) only implements a simple HN 'Who is Hiring' search via the gh CLI. It also references files (references/hn_jobs_guide.md) that are not present. The required tooling (gh CLI) matches the code, but several claimed capabilities are not implemented.
- Instruction Scope
- noteSKILL.md asks for gh CLI auth, Python 3.6+, and 'browser or web fetch' for external boards. The Python file only calls gh to query GitHub search and prints results; it does not attempt to read other system files or environment variables. However the instructions and Quick Start imply broader scraping (YC, remoteok, weworkremotely) that the code does not perform.
- Install Mechanism
- okNo install spec and only a small Python script are provided. Nothing is downloaded or written by an installer. This low-install footprint is consistent with an instruction-only skill.
- Credentials
- okNo environment variables or credentials are declared. The script does require an authenticated gh CLI to access GitHub; that is proportional to the HN search use. No unrelated credentials or config paths are requested.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; it does not request persistent/always-on privileges or modify other skills. Autonomous model invocation remains enabled by default but is not combined with broad credentials or suspicious behaviors here.