Skillv1.0.0

ClawScan security

J · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 12, 2026, 2:53 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only helper for joining/merging files and strings; its instructions match the stated purpose and it requests no credentials or installs.
Guidance: This skill is a documentation/cheatsheet for merging files and strings — it does not install anything or ask for secrets. Before using it, ensure: (1) you run the shown commands only on files you intend to merge (they will read and potentially overwrite output files), (2) backup originals before bulk operations, (3) required external tools (jq, csvstack/csvjoin, pandoc, node, iconv) are present on your system if you plan to use those examples, and (4) be cautious about running example scripts on untrusted files (the Node example reads and parses JSON). If you need the agent to operate autonomously, confirm it has explicit, limited file access so it cannot read sensitive files by accident.

Purpose & Capability: okThe name and description (join/merge/concatenate) match the SKILL.md content: examples show cat, paste, join, jq, simple Node script, csv tools, pandoc, iconv, etc. Nothing requested or described suggests capabilities beyond file/data merging.
Instruction Scope: noteThe instructions explicitly tell the agent to read and concatenate local files and run local commands (cat, paste, awk, jq, node, etc.), which is expected for this purpose. This does mean the agent will read any files you ask it to merge and may run a Node script example; the doc does not instruct access to unrelated system paths or external endpoints.
Install Mechanism: okNo install spec (instruction-only), so nothing is written to disk by the skill itself — lowest install risk. Note: the examples reference external tools (jq, csvstack/csvjoin, pandoc, iconv, node) that are not installed by the skill; the agent environment must already have them available to run those commands.
Credentials: okThe skill requires no environment variables, credentials, or config paths. There are no unexplained secret requests or access to unrelated services.
Persistence & Privilege: okalways is false and the skill has no install/persistence behavior. It does not request elevated or permanent presence in the agent environment.