Back to skill
Skillv1.0.0
ClawScan security
Batch Processor 1.0.0 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 3, 2026, 6:17 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are consistent with a document batch-processing helper; nothing requested is disproportionate or unrelated to its stated purpose.
- Guidance
- This skill appears coherent for bulk document processing. Before installing or running: (1) run pip installs in a virtualenv and add tqdm if you want progress bars; (2) ensure the agent/process you give this skill has only the file-system access it needs (it will read input files and create checkpoint.json in the working directory); (3) validate or scan input files (malicious documents can exploit processors); (4) if you plan autonomous runs, restrict the agent's file-path scope to prevent unexpected file access. If you need stronger guarantees, ask the author for explicit input validation and a minimal dependency list.
Review Dimensions
- Purpose & Capability
- okThe name/description (bulk document processing) matches the SKILL.md contents: design patterns, Python code examples using concurrent.futures, checkpointing, and suggested document libraries. The listed pip packages (python-docx, openpyxl, python-pptx, reportlab, jinja2) are relevant for converting and manipulating office files and PDFs.
- Instruction Scope
- okInstructions stick to processing user-provided files, progress tracking, and checkpointing. The examples read and write files within the working directory (e.g., checkpoint.json) which is expected for a batch processor. There are no instructions to exfiltrate data, call unrelated external services, or access system credentials. A minor note: the prose allows the agent discretion ('I'll execute the appropriate operations')—this is normal for instruction skills but means the agent will need permission to run file operations and code execution.
- Install Mechanism
- noteThis is an instruction-only skill (no install spec). The SKILL.md suggests installing Python packages via pip, which is proportionate. Minor inconsistency: the examples use tqdm for progress bars but tqdm is not included in the pip install command—add it if you expect CLI progress bars. No downloads from unknown hosts or archive extraction are present.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. The only file artifact is a local checkpoint (checkpoint.json) created in the working directory — this is appropriate for resume-safe batch jobs.
- Persistence & Privilege
- okalways is false and the skill does not request permanent presence or elevated privileges. It writes/reads its own checkpoint file but does not modify other skills or system-wide settings.