Skillv1.1.0

ClawScan security

Break Even Calculator Ecommerce · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 30, 2026, 10:09 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only break-even calculator for ecommerce; its requested footprint (no installs, no env vars, no code) matches its stated purpose.
Guidance: This skill is internally consistent and lightweight: it provides templates and formulas and does not request credentials or install code. Before using, ensure your inputs (COGS, return rates, fixed costs, CPA) come from reliable sources and label confidence levels as recommended; do not treat these models as formal accounting/tax or cash-flow forecasts. If you plan to automate feeding sensitive financial data into any agent, review data handling and storage policies first (this skill itself does not include code to store or transmit data).

Purpose & Capability: okThe name/description (ecommerce break-even modeling) aligns with the contents: formulas, templates, cost taxonomy, sensitivity templates and a model checklist. There are no unrelated requirements (no cloud credentials, no unusual binaries) that would contradict the stated purpose.
Instruction Scope: okSKILL.md and supporting files strictly describe data inputs, calculation steps (contribution margin, BE units, BE CPA/ROAS), sensitivity analysis, and decision framing. The instructions do not ask the agent to read arbitrary files, access system state, or send data to external endpoints beyond producing the model output.
Install Mechanism: okNo install spec and no code files — this is instruction-only. That minimizes on-disk execution risk; nothing is downloaded or installed.
Credentials: okThe skill requests no environment variables, credentials, or config paths. All required inputs are business metrics the user is expected to provide manually; there are no disproportionate secret or system access requests.
Persistence & Privilege: okThe skill is user-invocable and not marked always:true. It does not request persistent presence or modify other skills/config. Autonomous invocation is allowed by platform default but combined with the low footprint here it does not introduce additional concerns.