Back to skill
Skillv1.0.0
ClawScan security
AntV Skills · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 9:22 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's description, runtime instructions, and required footprint are internally consistent: it's an instruction-only G6 v5 code-generation/reference skill and it doesn't request unrelated credentials, installs, or system access.
- Guidance
- This skill is a set of G6 v5 usage guidelines and examples (instruction-only). It appears coherent and doesn't request secrets or perform installs, but note: (1) it assumes you have or will include @antv/g6 v5 in your project — the skill will not install that for you; (2) the source/homepage is missing, so verify examples against your installed G6 version (especially if you still use v4); (3) generated code will run in your environment/browser — review any generated code before executing it in production. If you need the skill to fetch libraries or run code, prefer a vetted package with a known homepage/source.
Review Dimensions
- Purpose & Capability
- okName/description (AntV G6 v5 graph code generation) matches the provided SKILL.md and many G6 reference documents; nothing in the package asks for unrelated capabilities (no cloud creds, no binaries).
- Instruction Scope
- okSKILL.md and the reference files contain coding guidelines and examples limited to constructing G6 Graph instances and related behaviors/layouts. They do not instruct the agent to read arbitrary host files, exfiltrate data, call unknown endpoints, or access environment variables beyond typical coding context.
- Install Mechanism
- okThere is no install spec and no code files that would be executed on install; this instruction-only skill does not download or write code to disk.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths. References to @antv/g6 are appropriate for the stated purpose and are expected to be provided by the user's runtime/project environment.
- Persistence & Privilege
- okalways is false and the skill is user-invocable with normal autonomous invocation settings; it does not request permanent system presence or modify other skills' configurations.