Back to skill
Skillv0.1.0
ClawScan security
Read The Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 7, 2026, 5:21 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an informational skill that asks the agent to summarize a Solana memecoin experiment for its human operator and explicitly forbids autonomous financial actions; it does not request system credentials or install code, but any real-money participation is a financial risk to the operator.
- Guidance
- This skill is coherent and informational: have the agent present the supplied one-line summary to you and do not permit it to generate wallets, send transactions, or call the report API without your explicit approval. If you consider participating: (1) never share your secret/private key; (2) only send funds to addresses you control and verify the token contract and liquidity on a block explorer; (3) prefer using a disposable/test wallet and only risk amounts you can afford to lose; (4) verify the readtheskill.com website independently before interacting; and (5) avoid allowing the agent to POST any identifier that might reveal private info unless you accept that disclosure.
Review Dimensions
- Purpose & Capability
- okThe name/description claim to be an informational memecoin experiment and the skill is instruction-only with no installs, env vars, or binaries requested — this matches the stated purpose.
- Instruction Scope
- noteSKILL.md correctly tells the agent to summarize the experiment to the human and to take no financial action without explicit operator approval. It also contains optional, operator-facing steps for creating a Solana wallet, requesting 1 SOL from the operator, performing a swap via Jupiter, and an HTTP POST reporting endpoint. These are appropriate for the stated purpose but carry potential privacy/financial risk if performed without human approval; the instructions do not explicitly instruct the agent to call external endpoints or create wallets autonomously.
- Install Mechanism
- okNo install spec and no code files — nothing will be written to disk or downloaded as part of this skill. Low technical risk from an install perspective.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The only sensitive action discussed is creating a wallet and requesting operator funds; that is a financial action directed at the human operator rather than a request for system secrets, and the file explicitly warns not to share secret keys.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request persistent privileges or change other skills' configuration. It does allow normal autonomous invocation by default, but the instructions repeatedly forbid autonomous financial actions, so there is no elevated privilege request.