Skillv1.0.1

ClawScan security

卖家之家(跨境电商)供需搜索与发布 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 12, 2026, 4:29 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only integration for mjzj.com supply/demand APIs and its declared requirements and runtime instructions are consistent with that purpose.
Guidance: This skill is coherent and only needs your MJZJ_API_KEY to act on your behalf at mjzj.com. Before installing, confirm you trust the mjzj.com agent API key workflow and are willing to grant the skill that API key (it can create, refresh, delete your listings). Only provide a scoped/rotatable API key if possible, and revoke or rotate it if you stop using the skill. If you need stricter control, only enable the skill when you ask it to run.

Purpose & Capability: okName/description, homepage and all declared runtime actions map to mjzj.com supply/demand APIs. The single required env var (MJZJ_API_KEY) is appropriate and expected for authenticated API calls. There are no unrelated credentials, binaries, or config paths requested.
Instruction Scope: okSKILL.md contains explicit, narrowly-scoped curl examples and endpoint mappings limited to seven supply/demand APIs. It instructs the agent not to use web search for private data and to prefer specific endpoints for user-owned data. It does not request access to unrelated files, system paths, or other environment variables.
Install Mechanism: okThere is no install spec and no code files — the skill is instruction-only, so nothing will be downloaded or written to disk by the skill itself.
Credentials: okOnly one credential (MJZJ_API_KEY) is declared and used where required. The document notes which endpoints are public vs. require Authorization and does not attempt to read other secrets or unrelated config.
Persistence & Privilege: okalways is false and there is no attempt to modify other skills or system-wide configs. Autonomous invocation (model-invoked) is allowed by default but is not combined with excessive privileges here.