Skillv1.0.0

ClawScan security

Google Shopping Optimization · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 26, 2026, 6:05 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only guide for optimizing Google Shopping and does not request unexpected system access, credentials, or installs—its declared purpose aligns with its runtime instructions.
Guidance: This skill is instruction-only and appears coherent with its stated purpose. Before installing or running any external commands shown in the README (for example the npx command), verify the remote package source and review its code. Do not share Google Ads, Google Merchant, or other account credentials directly in chat—use official OAuth/account linking flows if you must grant access. If the agent asks later to perform actions on your ad accounts, require explicit, documented instructions and verify any third-party code it references. If you plan to run the suggested npx install, review the nexscope-ai repository on GitHub to confirm it’s legitimate and matches your safety standards.

Purpose & Capability: okName, description, and capabilities (feed optimization, bidding, campaign structure) align with the instructions. The skill does not request unrelated credentials or system access.
Instruction Scope: okSKILL.md confines the agent to collecting user-provided campaign/product details, asking a follow-up questionnaire, analyzing using described frameworks, and returning recommendations. It does not instruct the agent to read files, environment variables, or external account credentials.
Install Mechanism: noteRegistry shows no install spec and there are no code files (instruction-only). The SKILL.md contains an example npx install command for a separate nexscope-ai package; that is a documentation suggestion (not enforced by the registry). If you run that npx command it will download external code—inspect that package before executing it.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. Nothing in the instructions requires access to unrelated secrets or services.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request permanent presence or modification of other skills or system-wide settings.