Back to skill
Skillv1.0.1
ClawScan security
Breathwork Facilitator Video · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 8, 2026, 2:35 PM
- Verdict
- suspicious
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's name/branding (breathwork facilitator) doesn't match the SKILL.md content (extensive financial-advisor marketing video guidance), which is an incoherence that should be clarified before installing; otherwise the skill appears instruction-only with no elevated technical risks.
- Guidance
- Do not assume this skill will produce breathwork-focused videos despite its name — the SKILL.md is focused on financial advisor marketing. Before installing: (1) inspect the full SKILL.md to confirm there are no hidden steps that request client PII, credentials, or external uploads; (2) ask the publisher/author to explain the naming mismatch and confirm the intended audience; (3) if you plan to use outputs as client-facing guidance, ensure the skill includes appropriate legal/disclosure text and that a qualified human reviews any financial recommendations; and (4) test the skill in a safe environment and review generated content for regulatory or compliance issues. If the mismatch isn't resolved, treat the skill as unreliable for breathwork use.
Review Dimensions
- Purpose & Capability
- concernThe package is named and keyworded as a "breathwork facilitator video" tool, but the SKILL.md content and use-cases are overwhelmingly focused on financial planning, RIAs, fiduciary messaging, and retirement planning. That mismatch between name/branding and the actual instructions is incoherent — it could be a mislabel, repurposed content, or an attempt to target multiple unrelated audiences. A user expecting breathwork-focused functionality would not legitimately need financial-advisor guidance and vice versa.
- Instruction Scope
- noteSKILL.md appears to be a large, self-contained set of content-generation instructions for creating marketing videos and scripts for financial advisors. No install steps, system commands, or references to reading local files, config paths, or external credentials are present in the visible portion. However the file is long and truncated in the registry view; you should inspect the full SKILL.md for any prompts that ask the agent to collect user PII, client financial data, or to transmit content to external endpoints or APIs (none are declared). Also note this skill's content generation can produce outputs that resemble financial advice — the SKILL.md should include disclaimers and guardrails, but those are not visible here.
- Install Mechanism
- okThis is an instruction-only skill with no install spec and no code files. That minimizes technical installation risk (nothing is written to disk or downloaded).
- Credentials
- okThe skill declares no required environment variables, no primary credential, and no required config paths. There is no apparent request for secrets or unrelated service credentials, which is proportionate to a text/template/content-generation skill.
- Persistence & Privilege
- okalways is false and the skill is user-invocable with normal model invocation allowed. There is no request for elevated or permanent presence or modifications to other skills or system-wide config according to the metadata.