Back to skill
Skillv1.0.0
ClawScan security
Target Market Selection Pvp Index · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 23, 2026, 2:29 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- Instruction-only marketing helper that asks for business descriptions and candidate segments and does not request credentials, install code, or access unrelated system resources — its declared purpose aligns with its instructions.
- Guidance
- This is an instruction-only marketing skill; before installing, note that it will ask you to paste or describe your business and candidate customer segments — avoid pasting sensitive personal data, credentials, or proprietary secrets. Because the skill is driven by user-supplied input, verify the produced scores and customer avatar yourself (models can misinterpret ambiguous inputs). There is no software to install and no external credentials requested, so the main risk is accidental disclosure of confidential information in the text you provide. If you want to limit automated runs, keep the skill user-invocable rather than enabling any always-on behavior.
Review Dimensions
- Purpose & Capability
- okThe name/description (selecting a target market using the PVP Index) matches the SKILL.md tasks (score segments, rank, pick primary target, build customer avatar). No unrelated binaries, env vars, or capabilities are requested.
- Instruction Scope
- okRuntime instructions operate only on user-provided business descriptions and market segments, produce a ranked table and customer avatar, and ask for clarifying input when needed. The instructions do not reference system paths, credentials, or external endpoints.
- Install Mechanism
- okNo install spec and no code files — the skill is instruction-only so nothing is written to disk or downloaded.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths; its requests for user-provided business data are proportionate to the stated marketing purpose.
- Persistence & Privilege
- okalways is false and the skill is user-invocable; autonomous model invocation is permitted by platform default but the skill itself does not request persistent or elevated privileges.