Skillv1.0.0

ClawScan security

detect opened proxy · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 6, 2026, 3:26 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code and instructions match its stated purpose (detect and test system proxies); it requires no credentials, has no install step, and performs only local/system queries and TCP checks to proxy addresses.
Guidance: This skill appears coherent with its stated purpose. Before running: review the included script (already bundled) if you want assurance, and be aware it will (a) run OS commands: reg (Windows) or networksetup (macOS), and (b) open short TCP connections to any detected proxy host/port and to a list of common local proxy ports (e.g., 127.0.0.1:7890, 8080, etc.). If you are concerned about network probes, run it in a restricted environment or while disconnected from untrusted networks. No credentials or external endpoints are used by the skill.

Purpose & Capability: okThe name/description claim to detect system proxy settings and test availability; the Python script queries Windows registry (reg) and macOS networksetup, falls back to common proxy addresses, and attempts TCP connections to test proxies — all consistent with the stated purpose.
Instruction Scope: noteSKILL.md directs running the included script and expects JSON output; the script does exactly that. Note: at runtime it will execute system commands (reg, networksetup) and open TCP connections to detected proxy hosts and to several common local ports — this is expected for availability testing but does cause outgoing connection attempts to whatever proxy host/port is configured.
Install Mechanism: okInstruction-only skill with no install spec. No code is downloaded from external URLs and the bundled script is included in the package.
Credentials: okThe skill requests no environment variables, no credentials, and no config paths. The system queries it performs (registry and networksetup) are proportional to proxy detection.
Persistence & Privilege: okThe skill is not always-enabled, doesn't request elevated privileges or modify other skills/system configuration, and only runs when invoked.