Back to skill
Skillv1.0.0
ClawScan security
biodiversity corridor calculator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousFeb 17, 2026, 3:25 AM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's described functionality (H3-based corridor analysis) matches the API endpoints in the instructions, but the skill calls an undocumented third‑party API (no source/homepage), which raises provenance and data‑privacy concerns before you send geolocation data to it.
- Guidance
- This skill appears to do what it says (send H3 indices to an analysis API), but exercise caution before enabling it: 1) Provenance: there is no source repo or homepage — verify the API owner/trustworthiness (https://www.nikhilp.online) before sending real project data. 2) Data sensitivity: the skill will transmit geolocation/H3 indices and center coordinates to a third party; do not send confidential or sensitive locations unless you trust the operator and their data handling policy. 3) Test safely: try with synthetic or public data first and confirm responses and rate‑limit behavior. 4) If you need stronger guarantees, prefer a skill backed by a known organization or a local/offline implementation, or require an authenticated API on infrastructure you control. 5) If you allow autonomous invocation, limit the agent's scope so it cannot repeatedly send location data without explicit user approval.
Review Dimensions
- Purpose & Capability
- noteName/description align with the runtime instructions: the SKILL.md tells the agent to POST H3 indices and a center coordinate to an API that claims to perform connectivity and ecological-value analysis. The skill does not request unrelated credentials or binaries. However, there is no source repository or project homepage and the API host (https://www.nikhilp.online) is undocumented — lack of provenance is noteworthy even though the technical capability is consistent with the stated purpose.
- Instruction Scope
- concernThe instructions are narrowly scoped to calling a single external API endpoint (POST /api/analyze) with H3 indices and center coordinates. They do not instruct the agent to read local files or access unrelated environment variables. The main concern is that the skill directs potentially sensitive geolocation data (projectHexes, centerLat/centerLng) to an external, unknown third‑party server; that is a privacy/trust risk even though it is functionally coherent.
- Install Mechanism
- okThere is no install spec and no code files — instruction-only. This is low risk in terms of local code execution or disk writes.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. That is proportionate to an instruction-only skill that simply calls a public API. The lack of authentication could mean the API is public or expects no secrets — which is consistent but also means calls are unauthenticated and rate-limited as noted.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide modifications or persistent privileges. The skill can be invoked autonomously by the agent (default), which is normal; consider limiting autonomous invocation if you don't want the agent sending data to the external API without prompting.