Back to skill
Skillv1.0.0
ClawScan security
moat-finder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 3:57 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only, internally consistent
- Guidance
- This skill appears coherent and low-risk: it is an instruction-only interview template that uses two local reference documents and asks the agent to probe a company's moats according to a strict framework. Before installing, consider: (1) fix the filename mismatch in SKILL.md so the agent can reliably find the reference files (change the SKILL.md references to references/01_factors.md and references/02_relations.md or rename the files); (2) decide whether you want the agent to perform external web research — if the agent has browsing/network access it may fetch public company data; restrict that if you prefer local-only operation; (3) test the skill on a non-sensitive public company first to confirm the agent follows the strict category rules and the 2-questions-per-turn limit. No secrets or system access are requested by this skill.
Review Dimensions
- Purpose & Capability
- okSkill name, description, and included reference files align: the skill is a consultant-style interviewer that evaluates competitive moats using the specified 5-factors + 4-relations framework. It does not request unrelated binaries, credentials, or config paths.
- Instruction Scope
- noteSKILL.md limits the agent to category-pure questioning and a 5-step workflow that only references the bundled reference files and asking follow-up questions. Two issues to note: (1) SKILL.md refers to files named references/01_factors_detailed.md and references/02_relations_detailed.md, but the package contains references/01_factors.md and references/02_relations.md — a filename mismatch that may confuse an agent expecting the exact names; (2) the workflow says it will 'research first' for public companies but does not specify where to fetch external data, which means an agent with web/browsing access could attempt external lookups (this is expected for a research task but is not made explicit). No instructions attempt to read unrelated system files or exfiltrate secrets.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files to execute or download. Nothing will be written to disk by an installer.
- Credentials
- okThe skill requests no environment variables, credentials, or special config paths — appropriate and minimal for its stated purpose.
- Persistence & Privilege
- okalways is false and the skill does not request permanent presence or modification of other skills or system-wide settings. Normal autonomous invocation is allowed by platform default but is not unusually privileged here.