Back to skill
Skillv1.1.0
ClawScan security
每日穿衣指南 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 7, 2026, 4:41 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions match its stated purpose (daily fengshui clothing color suggestions), request only python3, perform no network I/O or secret access, and do not exhibit incoherent or disproportionate behavior.
- Guidance
- This skill appears internally consistent and low-risk: it only runs the provided Python script locally, uses system time, and does not access the network or secrets. Before installing, consider whether the simple date-to-地支 algorithm (base date 2024-01-01) meets your accuracy needs and be aware it uses the agent host's local clock/timezone when computing today/tomorrow.
Review Dimensions
- Purpose & Capability
- okName/description (give color suggestions based on 地支/五行) align with required binary (python3) and included script (attire.py) that computes 地支 and maps to 五行/颜色. No unrelated credentials, binaries, or config paths are requested.
- Instruction Scope
- okSKILL.md requires calling the bundled script to obtain the 地支 and produce advice; the script only reads system time and performs local computation. It does not read other files, environment variables, or send data externally. (Note: the script uses a simple algorithm with a fixed base date for calculating 地支 — this is a correctness/accuracy concern, not a security one.)
- Install Mechanism
- okNo install spec is provided (instruction-only style) and the only runtime dependency is python3. Nothing is downloaded or written to disk beyond running the included script.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The skill does not attempt to access secrets or unrelated services.
- Persistence & Privilege
- okThe skill is not forced-always; it is user-invocable and can be invoked autonomously per platform defaults. It does not modify other skills or system-wide settings and does not request elevated persistence.