Skillv0.7.27

ClawScan security

Startup Agent (→ raon-os) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 21, 2026, 1:29 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This skill is simply an alias that points installers to the raon-os package; it contains no code, no install steps, and requests no credentials — review raon-os itself before installing for full assessment.
Guidance: This alias package itself is low-risk: it contains no code and requests no credentials. However, it simply points to the raon-os package for functionality. Before installing raon-os (clawhub install raon-os), review raon-os's SKILL.md, install spec, and package files to check for: required environment variables or API keys (e.g., Kakao integration may need tokens), any download URLs or extracted archives, use of external endpoints, always:true or broad credential access, and any scripts that run on install. If you are not comfortable with raon-os's requested permissions or install behavior, do not install it. If you want, provide the raon-os package contents and I can evaluate that package in the same way.

Purpose & Capability: okThe name/description match the content: SKILL.md states explicitly this is an alias for raon-os and directs users to install raon-os. package.json only includes SKILL.md and metadata, which is proportionate for an alias.
Instruction Scope: noteThe runtime instructions only say 'clawhub install raon-os'. That's expected for an alias, but the SKILL.md delegates all functionality and security surface to the raon-os package — this alias does not provide details about what raon-os will install or require.
Install Mechanism: okNo install spec and no code files are present in this package — nothing is written to disk by this alias itself. Installation risk depends entirely on the referenced raon-os package.
Credentials: okThis alias declares no required environment variables, credentials, or config paths. There is no disproportionate credential request in the alias itself.
Persistence & Privilege: okThe skill does not request always:true and is user-invocable only. It does not modify other skills or request elevated persistence.