Skillv1.0.0

ClawScan security

my skills · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 19, 2026, 3:30 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: An instruction-only skill that provides domain guidance for loan origination; it requests no credentials, installs, or system access and is coherent with its stated purpose.
Guidance: This skill is instruction-only and appears coherent with its purpose: it provides expert guidance for loan origination and asks for no credentials or installs. Before installing, consider provenance: the source/homepage is unknown, so if you plan to rely on this for real loan decisions or to share confidential borrower data, verify the author or run outputs by a human compliance officer. Remember that while the skill itself doesn't request secrets, any agent using it could still be asked by you to process sensitive documents — avoid submitting private borrower data unless you trust the environment and review results for regulatory compliance.

Purpose & Capability: okThe name/description and the SKILL.md content align: the skill is a domain-expert guide for commercial, construction, and reverse mortgage origination. It does not request unrelated resources, binaries, or credentials.
Instruction Scope: okSKILL.md is high-level, domain-specific guidance (qualification, underwriting, structuring, compliance, coordination). It does not instruct the agent to read files, access environment variables, call external endpoints, or collect/transmit data outside normal agent behavior.
Install Mechanism: okNo install spec or code files are present (instruction-only). Nothing is written to disk and there are no download/install steps to evaluate.
Credentials: okThe skill declares no required environment variables, credentials, or config paths — none are needed for the described advisory/origination guidance.
Persistence & Privilege: okalways is false and the skill does not request elevated persistence or modify other skills. disable-model-invocation is default (false), which is normal and not by itself a concern.