Back to skill
Skillv3.0.0
ClawScan security
Data Analysis · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 30, 2026, 10:14 AM
- Verdict
- Benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill’s requirements and runtime instructions are consistent with a data-analysis integration that calls the AnyGen CLI/API, but you should review the AnyGen service and npm package before uploading sensitive data because the skill’s source/homepage is not provided.
- Guidance
- This skill delegates analysis to the AnyGen service via the anygen CLI and needs your ANYGEN_API_KEY. Before installing or using it: (1) confirm you trust AnyGen (check their website, privacy/retention policy, and where data is stored) because data will be sent to www.anygen.io; (2) inspect the @anygen/cli npm package repository/source code if possible (the manifest doesn’t include a homepage); (3) avoid uploading highly sensitive or regulated data unless you’ve verified compliance and key scoping; and (4) prefer issuing an API key with minimal permissions and the ability to revoke it if needed.
Review Dimensions
- Purpose & Capability
- okThe skill is described as a data-analysis/visualization helper and requires the AnyGen CLI (anygen) and an ANYGEN_API_KEY — both are appropriate and expected for a cloud-based data-analysis integration. Minor note: registry metadata lists no homepage and source is unknown, so the external service and package provenance are not verifiable from the manifest.
- Instruction Scope
- okSKILL.md instructs only to use the anygen CLI (commands like anygen auth login and anygen skill install) and to call AnyGen’s service (www.anygen.io). It does not instruct the agent to read arbitrary local files, unrelated env vars, or exfiltrate data to unexpected endpoints. It does require an interactive browser login flow for auth when used.
- Install Mechanism
- noteInstallation is via an npm-scoped package (@anygen/cli) that creates the anygen binary — this is a common pattern but carries the usual moderate risk of third-party npm packages. There is no direct archive download or obscure URL. Because the manifest lacks a homepage/source, you should inspect the package repository before installing.
- Credentials
- okOnly ONE credential (ANYGEN_API_KEY) is required and declared as the primary credential. That aligns with a single external API service and is proportionate to the skill’s stated purpose.
- Persistence & Privilege
- okThe skill does not request always:true and uses default invocation settings. It does not ask to modify other skills or system-wide agent configs according to the manifest, so its persistence/privilege level is appropriate.