Back to skill
Skillv1.0.0

ClawScan security

audiogram-creator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 29, 2026, 12:50 PM
Verdict
benign
Confidence
high
Model
gpt-5-mini
Summary
The skill is an instruction-only audiogram guidance pack whose requirements and instructions align with its stated purpose and it does not request extra credentials, installs, or system access.
Guidance
This is an instruction-only resource (guides and code examples) and appears internally consistent. Before using it in an automated workflow, be mindful: 1) only feed audio and transcripts you are comfortable sharing with the agent; 2) if you later implement the provided examples to export or post to social platforms, those implementations will require platform credentials — review any code that you install or run that adds network calls or stores tokens; 3) if you adapt the examples into executable code, audit that code for network endpoints and credential usage. Otherwise, the skill itself does not request unexplained access or installs.

Review Dimensions

Purpose & Capability
okThe name/description (audiogram creation, captions, templates, batch workflows) match the SKILL.md and examples. The skill requests no binaries, env vars, or installs — all proportional to a documentation/instruction-only skill.
Instruction Scope
okSKILL.md contains workflows, TypeScript-style examples, templates and best practices. It does not instruct the agent to read unrelated system files, access credentials, or send data to external endpoints. User-provided audio/transcripts are assumed inputs, which is appropriate.
Install Mechanism
okNo install spec and no code files that would be written to disk. This is the lowest-risk pattern for a skill of this type.
Credentials
okThe skill declares no required environment variables, credentials, or config paths. Nothing in the instructions requires hidden secrets or unrelated service tokens.
Persistence & Privilege
okalways is false and the skill does not request persistent or elevated privileges, nor does it modify other skills or system settings.