Back to skill
Skillv1.0.0
ClawScan security
git-weekly · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 2:58 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions match its stated purpose (analyzing a week's Git commits) and it does not request extra credentials or install arbitrary code, but it assumes access to a Git repository/binary (not declared) and will read commit diffs which can contain sensitive content.
- Guidance
- This skill appears to do what it says: run git for the last 7 days of your commits and produce a technical weekly report. Before installing/using it, confirm the agent will run the git command only in repositories you trust (commit diffs can contain secrets or private data). Also note the package metadata does not list git as a required binary — ensure git is available and consider adding an explicit check or prompt before executing commands. If you want extra safety, run the skill in a copy of the repo or require user confirmation before it executes git commands.
Review Dimensions
- Purpose & Capability
- noteThe skill is described as a weekly Git-commit analysis tool and its SKILL.md explicitly runs git log and inspects diffs — that aligns with the purpose. However, the registry metadata claims no required binaries or env vars while the instructions require a working git command and a repository context (and use git config user.name). The missing declaration of git as a required binary is an inconsistency.
- Instruction Scope
- noteInstructions are narrowly focused on running `git log --since="7 days ago" --author="$(git config user.name)" --reverse --patch` and searching diffs for keywords, then producing a structured report — this stays within the stated purpose. Important caveat: commit diffs may include sensitive data (API keys, credentials, PII). The skill does not include any safeguards or warnings about handling secrets present in commits.
- Install Mechanism
- okThere is no install spec and no code files — the skill is instruction-only, which minimizes install risk.
- Credentials
- okThe skill declares no required environment variables or credentials and its instructions do not request external secrets. This is proportional to its purpose. Note: it does implicitly rely on local git config (user.name) and filesystem access to the repository.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated persistence or modify other skills or global agent settings. Autonomous invocation is allowed (platform default) but not combined with other red flags.