Back to skill
Skillv1.0.0
ClawScan security
Content Repurposer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 23, 2026, 8:20 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, runtime instructions, and requirements align with its stated purpose (repurposing articles into social formats); it does not request unrelated credentials or install remote code.
- Guidance
- This skill appears coherent and implements exactly what it says: fetching an article (only when you supply a URL), extracting text, and building platform-specific posts. Before installing or running: (1) inspect scripts/repurpose.py yourself (it is bundled and readable); (2) be aware the script will perform an HTTP GET to any URL you provide—avoid pointing it at internal or private endpoints; (3) install and run in an isolated environment if you are unsure (virtualenv/container); (4) note that generated content may reproduce copyrighted text from the source—review before posting; and (5) the agent can invoke the skill normally (default), so if you want to prevent autonomous runs, disable/limit skill invocation in your agent settings.
Review Dimensions
- Purpose & Capability
- okName/description (multi-platform repurposing) match the included code and SKILL.md. The script fetches article HTML (when URL mode is used), extracts body/title, and generates platform-specific outputs—these are expected capabilities. The SKILL.md mention of beautifulsoup4 is consistent with the script's runtime dependency.
- Instruction Scope
- okRuntime instructions are narrowly scoped to reading a URL, file, or stdin and producing social-media content. The SKILL.md does not ask the agent to read unrelated files, environment variables, or transmit data to endpoints other than the target article URL. The included code follows the same scope (HTML fetch + local text processing + local output).
- Install Mechanism
- okNo install spec is present and the SKILL.md suggests only installing beautifulsoup4 for URL extraction. There are no downloads from untrusted URLs or archive extraction steps in the package metadata. The code is bundled with the skill, so nothing is fetched during install.
- Credentials
- okThe skill does not request environment variables, credentials, or config paths. It operates without secrets and only uses network access to fetch the user-provided article URL, which is proportional to the stated purpose.
- Persistence & Privilege
- okalways is false and no special privileges or persistent modifications are requested. The skill does not modify other skills or system-wide agent settings in the visible files.