Back to skill
Skillv1.0.0
ClawScan security
Programming · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 3, 2026, 6:16 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files and runtime behavior are consistent with a programming-guidance helper: it only provides static documentation and a small shell wrapper that prints those documents, and it does not request credentials, install software, or perform network or file-exfiltration actions.
- Guidance
- This skill appears low-risk and consistent with its description: it only serves local documentation and a simple script that prints those docs. Before installing, consider whether you trust the skill author (source is unknown) and whether you want an agent that can autonomously call this skill — although it only returns static guidance, any downstream use (for example, following instructions to install or run Claude CLI) may trigger network activity. If you need stronger provenance, ask the author for a homepage or repository link and verify the script contents; if you want to be cautious, run the skill in a restricted environment or inspect the files locally before enabling it.
Review Dimensions
- Purpose & Capability
- okName/description (programming guidance, code review, workflow, Claude CLI examples) match the included markdown docs and the simple shell interface that serves those docs. There are no unrelated credentials, binaries, or config paths requested.
- Instruction Scope
- okSKILL.md and the other guides only describe programming tasks and how to use Claude CLI; the runtime script (skill.sh) only cats local markdown files from the skill directory and does not read arbitrary system files, call external endpoints, or access undeclared environment variables.
- Install Mechanism
- okNo install spec is provided and there are no dependencies declared. The skill is instruction-only with a small local shell script — nothing is downloaded or extracted during installation.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The content references using external tools (Claude CLI) but does not require or attempt to access any secrets itself.
- Persistence & Privilege
- okalways is false and the skill does not request modification of other skills or system-wide settings. Autonomous invocation is allowed (platform default) but the skill's behavior is limited to serving static docs and is not privileged.