Skillv1.0.1

ClawScan security

Cogmate Client · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 14, 2026, 12:05 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally coherent: it documents and implements simple curl-based clients for a Cogmate API and asks for a user-provided endpoint and token; nothing in the files suggests covert behavior or unrelated privileges.
Guidance: This skill is a simple client that needs a Cogmate endpoint URL and an access token you provide. Before installing/using: (1) confirm the COGMATE_URL you supply is trustworthy and use HTTPS to avoid token interception; (2) prefer supplying tokens via secure means rather than embedding them in shared command history (tokens in URL query params can appear in logs and browser history); (3) verify token scope/least-privilege (use qa_public or browse_public if full access isn't required); (4) review the two small scripts (they are plain curl+python JSON parsing) before running. The repository links in the README contain inconsistent example domains—double-check the real CogNexus/Cogmate documentation from the instance owner before obtaining tokens.

Purpose & Capability: okName/description (querying Cogmate personal knowledge systems) matches the provided SKILL.md, reference docs, and the two helper scripts which perform POST /api/ask and GET /api/visual/facts. There are no unrelated requirements (no cloud creds, no system binaries).
Instruction Scope: okRuntime instructions and scripts only call the documented Cogmate endpoints using a supplied URL and token. They do not read local files, access unrelated environment variables, or send data to third-party endpoints. The only minor concern is that tokens are passed as URL query parameters (per API design), which can leak via logs—this is a security/design note, not evidence of scope creep.
Install Mechanism: okNo install specification (instruction-only). The repo contains two small shell scripts; nothing is downloaded or installed automatically and no archives or remote installers are used.
Credentials: okThe skill requests no environment variables or primary credentials in the registry metadata; tokens are expected to be provided by the caller as arguments. The credential needs (a CogNexus/Cogmate token) are proportional to the stated functionality.
Persistence & Privilege: okSkill does not request persistent/always-on privileges, does not modify other skills or system settings, and uses standard agent-invocable defaults. No elevated system presence is requested.