Back to skill
Skillv0.1.0
ClawScan security
WPS macOS Helper · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 12:27 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, instructions, and included script are coherent with its stated purpose (macOS WPS document workflows); it does not request credentials or install third-party code and appears to stay within its scope.
- Guidance
- This skill looks coherent and low-risk: it provides local guidance files and a small helper script that can write an output .md and will invoke a local 'uvx' tool only if present. Before running, confirm you trust any local converter (uvx) the skill may call and provide an explicit output path to avoid accidental overwrites. If you want extra caution, review the included scripts/prepare_doc_workflow.sh content and run it manually rather than allowing an agent to invoke it autonomously.
Review Dimensions
- Purpose & Capability
- okName/description match the included references and the single helper script. There are no unrelated environment variables, binaries, or config paths requested; the provided script and markdown guidance are proportionate to preparing/converting documents for WPS on macOS.
- Instruction Scope
- noteSKILL.md confines actions to reading packaged references and optionally running scripts for conversion/preprocessing. The script may call an external converter ('uvx') if present and will write output files when an output path is supplied; this behavior is consistent with the stated conversion tasks but worth noting because it executes a local binary and creates files.
- Install Mechanism
- okNo install specification; instruction-only plus a small included shell script. Nothing is downloaded or extracted at install time, so no elevated install risk is present.
- Credentials
- okNo required environment variables, credentials, or config paths are declared or referenced. The script checks for a local 'uvx' binary but does not require secrets or remote credentials.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system presence or modify other skills. Autonomous invocation is allowed by platform default but is not combined with broad privileges here.