Skillv1.0.0

ClawScan security

打开深圳广电资讯 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 13, 2026, 9:30 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This instruction-only skill simply provides a voice trigger to open a Shenzhen广电 news webpage and does not request credentials, install code, or access other system data.
Guidance: This skill appears to only open the Shenzhen广电 news page (https://www.sztv.com.cn/ysz/zx/zw/80706997.shtml). Before installing, verify the URL yourself in a browser to confirm it’s the intended official page. Because it’s instruction-only and requests no secrets, it cannot exfiltrate credentials — however, installing gives the assistant a shortcut to open that link for you, so ensure you’re comfortable with the assistant opening external web pages. If you want stronger assurance, test the link manually first and only enable the skill if the link and content look legitimate.

Purpose & Capability: okName/description claim a one‑click voice shortcut to Shenzhen广电 news; the skill only lists a single target URL and requests no binaries, env vars, or config paths — these requirements match the stated purpose.
Instruction Scope: okSKILL.md only instructs the agent to open a specific URL when the trigger phrase is used. It does not ask the agent to read files, access credentials, or transmit unrelated data. The mechanics of how the platform performs the navigation are not specified but that's typical for an instruction-only skill.
Install Mechanism: okNo install spec or code files are provided (instruction-only), so nothing is written to disk or downloaded during install.
Credentials: okThe skill declares no required environment variables, credentials, or config paths — proportional for a simple URL-opening utility.
Persistence & Privilege: okalways is false and the skill is user-invocable. The skill can be invoked autonomously by the agent per platform defaults, but that alone is not a concern given the skill's minimal scope.