Skillv1.0.0

ClawScan security

Automation Workflows Temp · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 13, 2026, 9:48 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only playbook for designing no-code automation workflows; its requirements and instructions are consistent with its stated purpose and it doesn't request credentials or install code.
Guidance: This skill is an instruction-only playbook and appears coherent with its stated purpose. Before installing or using it: (1) verify the skill source/author (registry owner ID and the _meta.json ownerId differ), and prefer skills with a clear homepage or author profile; (2) read the full SKILL.md to ensure no hidden steps you disagree with; (3) when connecting third-party tools (Zapier/Make/n8n) use the platforms' OAuth flows and only grant needed scopes; (4) be cautious about pasting sensitive credentials anywhere outside the provider's official auth dialogs; (5) because this skill can be invoked by the agent autonomously (normal default), only enable it if you trust the skill author and understand when it will run. If you want higher assurance, ask the publisher for a canonical source/landing page and a changelog or signed metadata.

Purpose & Capability: okName and description match the SKILL.md: a solopreneur automation playbook covering identification, tool selection (Zapier/Make/n8n), design, testing, and maintenance. The skill declares no binaries, env vars, or installs — all appropriate for an instruction-only guide.
Instruction Scope: okRuntime instructions are a how-to guide and do not instruct the agent to read local files, export secrets, call arbitrary endpoints, or perform other out-of-scope operations. They focus on workflow design, testing, and tool-specific setup (OAuth/authentication is expected for third-party platforms).
Install Mechanism: okNo install spec and no code files are present, so nothing is written to disk or fetched during install. This is the lowest-risk form for a skill of this type.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. The SKILL.md references auth flows for third-party automation tools in the expected context (e.g., OAuth when connecting Zapier), which is proportionate.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request persistent presence or modify other skills or system-wide settings.