Skillv1.0.0

ClawScan security

Audio To Text Caption · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 13, 2026, 2:27 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requested resources and instructions match its stated purpose (transcribe and clean audio for captions); there are no unexpected installs, credentials, or file accesses in the provided files.
Guidance: This skill is internally consistent and appears to do what it says: transcribe and clean audio for captions. However, because it is instruction-only it does not specify how transcription will be performed — the actual runtime behavior depends on the agent platform and any transcription tools or APIs available there. Before installing or using with sensitive content, confirm: (1) whether your agent/platform will use a local model or a third-party cloud ASR (and if cloud, where audio will be sent), (2) any privacy or retention policies for uploaded audio, and (3) licensing terms (the SKILL.md states a CC BY-NC-SA license and commercial use requires a paid license from Razestar). If you need to avoid external uploads, test with non-sensitive audio and verify the agent's configured toolchain or ask the platform how transcription is performed.

Purpose & Capability: okName, description, and SKILL.md all describe transcription, cleaning, and caption formatting; there are no unrelated required env vars, binaries, or install steps that would be disproportionate to that purpose.
Instruction Scope: okRuntime instructions are limited to transcribing audio, removing fillers, formatting for captions, and flagging unclear segments. The SKILL.md does not direct reading unrelated files, exfiltrating data, or contacting external endpoints. It does not specify the transcription implementation (local vs. external), which is an intentional omission rather than scope creep.
Install Mechanism: okNo install spec and no code files — instruction-only skill. This is the lowest-risk install surface; nothing is written to disk by the skill itself.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. There is no apparent need for secrets or unrelated credentials.
Persistence & Privilege: okalways:false and no install scripts or config writes. The skill does not request persistent system presence or elevated privileges.