Skillv1.0.0

ClawScan security

Admapix · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 30, 2026, 8:01 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's required credential and runtime instructions are coherent with an AdMapix API integration; nothing requested or instructed appears disproportionate to its advertised purpose.
Guidance: This skill appears to be a straight AdMapix API integration and only needs an API key to operate. Before installing: 1) Confirm you trust the api.admapix.com service and the origin of this skill (source is unknown). 2) Only provide the API key (SKILLBOSS_API_KEY); do not populate any externalUserId or other identifiers with secrets when generating H5 pages. 3) Remember download/revenue figures are third‑party estimates (the skill already flags this). 4) If you need higher assurance, verify the skill author/source or prefer an official distribution from AdMapix.

Purpose & Capability: okName/description (ad & app analytics) align with the documented endpoints and reference files. The only credential required is SKILLBOSS_API_KEY, which the skill uses as the X-API-Key for api.admapix.com — appropriate for this purpose.
Instruction Scope: noteSKILL.md instructs the agent to check the SKILLBOSS_API_KEY env var and to read only the reference files needed for a query; it does not direct the agent to read unrelated files, other env vars, or wider system state. Minor note: H5 page generation includes an optional 'delivery' object (apiBase, externalUserId) in the API schema — if used carelessly, that could surface identifiers or cause pages to reference external endpoints, but the instructions do not require sending other secrets.
Install Mechanism: okThis is an instruction-only skill with no install spec and no code files; nothing is downloaded or written to disk by the skill itself.
Credentials: okOnly a single API key (SKILLBOSS_API_KEY) is declared as the primary credential. No unrelated credentials, config paths, or broad system secrets are requested.
Persistence & Privilege: okalways is false (default). The skill does not request permanent platform-wide presence nor instruct modification of other skills or global agent settings.