Skillv1.0.0

ClawScan security

Passive Income Tracker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

ReviewMar 15, 2026, 5:27 AM

Verdict: Review
Confidence: medium
Model: gpt-5-mini
Summary: The skill claims a full multi‑platform tracker but the package is instruction‑only and contains no code or install spec while instructing the agent to run a CLI and to store many API keys — the materials are internally inconsistent and missing critical provenance and implementation details.
Guidance: Do not add real API keys or install this as-is. The package contains only docs and no runnable code or install metadata, yet its instructions expect an installed CLI and many platform API keys saved in a TOOLS.md file — this gap is concerning. Before proceeding, request the skill's source repository or a signed release and verify the actual CLI or code that will be installed. Confirm where TOOLS.md lives and how secrets are encrypted and backed up; prefer storing credentials in your secret manager (not plaintext in a repo or tool file) and use read-only tokens. If you must test, do so in an isolated environment with temporary/rotated API keys and verify the code that will run. If the author cannot provide a clear install artifact and source code, avoid installing the skill.

Review Dimensions

Purpose & Capability: concernThe skill's name/description promise a runnable tracker that integrates many platforms, but the bundle contains no code, no install spec, and no declared dependencies — yet SKILL.md and README show commands (clawhub run passive-income-tracker, clawhub install) that would require a CLI or runtime that isn't provided. This mismatch makes it unclear how the claimed capabilities would actually be delivered.
Instruction Scope: noteThe runtime instructions themselves stay within the stated purpose (sync, overview, report, forecast) and explicitly instruct adding platform API keys to TOOLS.md. They do not ask to read unrelated system files. However, they are vague about where TOOLS.md is stored, how keys are protected, and how 'local encryption' and backups are implemented — missing operational detail that affects security/privacy.
Install Mechanism: concernThere is no install specification and no code files in the skill bundle, yet README shows an install command and SKILL.md assumes an installed CLI. That discrepancy is a red flag: either the skill expects external artifacts that are not declared, or the README/instructions are misleading.
Credentials: concernThe registry metadata declares no required env vars, but the documentation instructs the user to supply many platform API keys (Gumroad, Patreon, YouTube, Stripe, PayPal, Amazon Associates, etc.). Requiring numerous credentials is plausible for the stated purpose, but the absence of declared required credentials and no guidance about least-privilege (e.g., read-only tokens) or secure storage is a proportionality and transparency concern.
Persistence & Privilege: okThe skill does not request always:true and is user-invocable only. It doesn't declare system-wide config modifications. From the metadata there is no elevated or persistent privilege requested by the skill bundle itself.