Back to skill
Skillv2.0.0
ClawScan security
Lianke Print Box · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 3:44 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are consistent with a remote cloud-print CLI: it only needs the lk-print binary and user-provided Lianke credentials to operate.
- Guidance
- This skill is internally consistent for controlling Lianke cloud printers via the lk-print CLI. Before installing, verify the GitHub repository (owner, stars, recent commits, release tags) to ensure you trust the binary you’ll install. Keep your API key and device keys private — do not paste them into public logs or share them. Consider testing installation and printing in a controlled environment first (not on production devices). If you are concerned about autonomous agent use, keep model-invocation limited or only invoke the skill manually.
Review Dimensions
- Purpose & Capability
- okThe skill is described as a wrapper around the lk-print CLI for cloud printing and scanning. The only required binary is lk-print and the SKILL.md shows CLI commands that match the stated functionality (device listing, print/scan, job status). There are no unexpected environment variables or unrelated capabilities requested.
- Instruction Scope
- okRuntime instructions only tell the agent to install the lk-print tool, run lk-print auth with an API key/device credentials, and call lk-print commands to print/scan/query. The instructions do not ask the agent to read unrelated system files, environment variables, or exfiltrate data to third-party endpoints beyond Lianke's service.
- Install Mechanism
- noteInstall is performed via a 'uv' package pointing to git+https://github.com/liankenet/lk-print-box.git which will produce an lk-print binary. Installing code from a GitHub repo is a reasonable way to obtain the CLI but carries the usual risk of running third-party code; users should verify the repository and its contents (owner, recent commits, release tags) before installing.
- Credentials
- okThe skill does not require environment variables or broad credentials. The SKILL.md instructs the user to provide an API key, device id, and device key to 'lk-print auth' — these are specific to the Lianke service and proportional to the skill's purpose.
- Persistence & Privilege
- okThe skill is not marked always:true and does not request system-wide configuration changes or cross-skill modification. It can be invoked by the agent (default), which is appropriate for this kind of integration.