Skillv1.0.0

ClawScan security

React Game Loop Hooks · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 28, 2026, 10:40 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, instructions, and metadata are coherent with its stated purpose (a browser-only React hook for game loops) and do not request extra credentials, install arbitrary binaries, or perform suspicious actions.
Guidance: This skill appears to be what it claims: a small, browser-only React hook for game loops. Before installing, review the hook to ensure it matches your app's type/encoding (TypeScript/React versions) and confirm you only copy the files into projects that run in the browser (not SSR/Node). The hook catches callback errors and cleans up RAF on unmount, but as with any third-party code, inspect it for fit and license compatibility (MIT) before use.

Purpose & Capability: okThe name/description (React game loop hooks) matches the included files and declared behavior. The files implement a requestAnimationFrame-based useGameLoop hook and an example component — nothing unrelated is requested.
Instruction Scope: okSKILL.md instructs the agent/user to copy the hook file into their project and documents API, patterns, and an example. Instructions are narrowly scoped to installing and using the hook; they do not instruct reading unrelated files, accessing environment variables, or contacting external endpoints.
Install Mechanism: okThere is no install spec and no download/install-from-URL behavior. The code is provided in the skill assets and the user is instructed to copy the file into their project — low-risk and transparent.
Credentials: okThe skill requests no environment variables, credentials, or system config paths. Declared dependencies (React/TypeScript/react-dom) are appropriate and expected for a TypeScript React hook.
Persistence & Privilege: okThe skill does not request always:true and uses default user-invocable/autonomous settings. It does not modify other skills or system-wide settings and does not persist credentials.