Back to skill
Skillv1.1.0
ClawScan security
Upcoming Metal Concerts · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 9:41 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are consistent with its stated purpose of scraping concerts-metal.com and storing results locally; it does not request credentials or perform unexpected actions.
- Guidance
- This skill appears to do exactly what it says: it scrapes concerts-metal.com and stores results in data/concerts.json. Before installing, be aware it will (1) perform outbound HTTP requests to concerts-metal.com (your machine/IP will contact that site), (2) create skill-config.json (default country ES) and write data under the skill's directory, and (3) rely on HTML structure of the target site (scraping may break if the site changes). No credentials are requested. If you want to restrict network access or inspect output, run the script manually first and review skill-config.json and data/concerts.json.
Review Dimensions
- Purpose & Capability
- okName/description match the included Python script and instructions. The only required binary is python3 and the script fetches pages from concerts-metal.com as advertised.
- Instruction Scope
- okSKILL.md instructs running the provided script, creating skill-config.json, and writing data to data/concerts.json. The runtime instructions and script only read/write files under the skill base directory and perform HTTP GETs to concerts-metal.com; they do not reference unrelated system files, env vars, or other endpoints.
- Install Mechanism
- okNo install spec — instruction-only with a bundled Python script. Nothing is downloaded from arbitrary URLs and no packages are installed automatically.
- Credentials
- okNo environment variables, credentials, or external tokens are requested. File read/write is limited to skill-config.json and data/concerts.json under the skill directory.
- Persistence & Privilege
- okalways is false. The skill will create its own config and data files in its base directory (normal). It does not modify other skills or system-wide settings.