Skillv1.0.0

ClawScan security

Quick Converter · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 10, 2026, 10:06 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only offline converter that only uses built-in formulas and static March 2026 reference rates; its requests and behavior are consistent with its stated purpose.
Guidance: This skill is low-risk and internally consistent: it performs offline conversions using formulas and static March 2026 reference rates. Before installing, note that currency and crypto values are estimates and may be stale — do not rely on this for trading or banking. Also be aware the skill defaults to IST/timezone and assumes USD when 'dollars' is ambiguous; ask the user to clarify when needed. If you need live exchange rates or transaction-grade accuracy, prefer a skill that explicitly requires and documents a trusted API key and live calls.

Purpose & Capability: okName/description (unit/time/currency/crypto conversions) match the SKILL.md: all actions are conversions using built-in formulas and static rates. No extraneous binaries, env vars, or config paths are requested.
Instruction Scope: noteInstructions stay within conversion/time tasks. Notes: currency/crypto rates are explicitly static (mid-March 2026) and the skill defaults to IST/Ahmedabad context for time calculations and assumes 'dollars' → USD unless clarified. This is functional but should be highlighted to users because values are estimates and may be stale.
Install Mechanism: okNo install spec and no code files — instruction-only skill, so nothing is downloaded or written to disk. Low installation risk.
Credentials: okRequires no environment variables, keys, or credential access. Requested capabilities are proportionate to the stated purpose.
Persistence & Privilege: okalways is false, no persistent/system-wide changes described, and the skill does not request elevated privileges or modify other skills' configs.