Skillv1.0.0

ClawScan security

OEE Content Humanizer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousFeb 14, 2026, 2:34 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill largely does what it says (rewrites text via Anthropic/Claude) but the registry metadata omits the required ANTHROPIC_API_KEY and the package's source is unknown — review before providing any sensitive text or credentials.
Guidance: This skill appears to perform the advertised task (it sends your text to Anthropic/Claude and returns a rewritten version), but note two things before installing or using it: (1) the code requires ANTHROPIC_API_KEY even though the registry metadata says no env vars — treat that metadata as incorrect and don't paste secrets into the skill without confirming how you'll manage the API key; (2) your input text is transmitted to api.anthropic.com (so avoid sending PII, credentials, or confidential content unless you accept that exposure and trust Anthropic and the skill's unknown author). If you want extra caution, request the publisher to correct the metadata, verify the author/homepage, or run the script in an isolated environment and inspect network egress (or use a local model) before providing sensitive text.

Review Dimensions

Purpose & Capability: noteThe skill's stated purpose (humanize AI-generated text) matches the code and instructions: it detects 'AI tells' and sends a rewrite prompt to Anthropic's Claude model. However, the registry metadata claims no required environment variables while SKILL.md and the code require ANTHROPIC_API_KEY — this metadata omission is an inconsistency.
Instruction Scope: okSKILL.md and humanize.py limit behavior to detecting keywords and sending a constructed prompt + user text to the Anthropic API; stdout is the rewritten text and stderr contains detection info. The instructions do not ask the agent to read arbitrary files, other env vars, or post data to unexpected endpoints.
Install Mechanism: okNo install spec (instruction-only with an included Python script). The script uses only the Python standard library (urllib) and makes an HTTPS call to api.anthropic.com. No external downloads, package installs, or archive extraction are present.
Credentials: concernThe code requires ANTHROPIC_API_KEY in the environment to operate — this is reasonable for a cloud LLM-based humanizer. However, the registry metadata does not declare this required env var or a primary credential, which is an incoherence that could mislead users about required secrets. The skill will transmit the full input text to Anthropic, so any sensitive content would be shared with that third party.
Persistence & Privilege: okThe skill does not request always:true, does not modify other skills or system configs, and does not store persistent credentials itself. It behaves like a transient CLI-style tool invoked per use.