Back to skill
Skillv1.0.0
ClawScan security
Research Planner · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 13, 2026, 2:47 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only research planning toolkit (templates + guidance) and its requested resources and instructions are consistent with that purpose.
- Guidance
- This skill appears to be a coherent planning and template toolkit for user/market research. It does not request credentials or attempt to run code. Before installing or using it: (1) remember the skill is for planning only — do not use it to process or analyze participant data; (2) when you generate materials that collect personal data (consent forms, recruitment messages), review them with your legal/privacy team and ensure you handle PII securely; and (3) if you later connect analysis or data-collection skills, confirm those separate skills' permissions and endpoints before handing over any sensitive data.
Review Dimensions
- Purpose & Capability
- okThe name/description (Research Planner) match the contents: detailed planning phases, method selection, and many templates. There are no unrelated requirements (no binaries, no env vars, no external credentials) that would be unexpected for a planning/template skill.
- Instruction Scope
- okSKILL.md and phase/template files confine the agent to planning, drafting materials, and logistics. The skill explicitly marks data collection, analysis, and reporting as out of scope and recommends handing those tasks to analysis-focused skills. The instructions do not ask the agent to read arbitrary system files, environment variables, or send data to unexpected endpoints.
- Install Mechanism
- okThis is instruction-only with no install spec and no code files to execute. The manual install snippet points to a GitHub tree but that is only an install hint; nothing is downloaded/executed by the skill itself in the provided metadata.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The templates include consent and privacy checklist items (appropriate for research planning) but the skill itself does not request sensitive credentials.
- Persistence & Privilege
- okFlags show always:false (normal), user-invocable:true, and model invocation enabled (default). There is no evidence the skill requests elevated or persistent privileges or that it modifies other skills or system-wide settings.