Skillv1.0.0

ClawScan security

Meshimize · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 9, 2026, 1:24 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally consistent with its stated purpose (routing questions and delegations to Meshimize groups), has no install or secret requirements, and does not ask the agent to read local files or unrelated credentials — but it will transmit user-provided content to external experts, so review data sensitivity before use.
Guidance: This skill appears coherent and low-risk from an installation perspective (no downloads, no secrets requested). The main risk is data leakage: when the agent uses this skill it will post your questions or tasks to external, human experts and delegations. Before installing, confirm that (1) the Meshimize integration/tool actually exists in your environment, (2) you understand who the external recipients are and their privacy/retention policy, and (3) you will avoid sending sensitive secrets or PII via this skill. If you need more assurance, request the skill owner/homepage or privacy terms, and try it first with non-sensitive test queries. If operator approval is required by your policy, preserve that step and do not bypass it.

Purpose & Capability: okThe SKILL.md describes a connector/workflow for Meshimize Q&A and delegation primitives (search/join/ask/post/create_delegation). The skill requires no binaries, env vars, or installs, which is appropriate for an instruction-only wrapper that expects platform-provided Meshimize tool calls.
Instruction Scope: noteInstructions are focused on group membership, asking questions, and creating delegations. They do not direct the agent to read local files, environment variables, or unrelated system paths. Important: the workflow explicitly sends user content to external groups/specialists (synchronous Q&A or asynchronous delegations), so user data will be transmitted outside the agent unless operator approval or redaction is applied.
Install Mechanism: okNo install spec or code files are present; this is instruction-only. That minimizes disk/code execution risk.
Credentials: okThe skill declares no required environment variables or credentials, which matches the instruction-only nature. Note: authentication/authorization is likely handled by the hosting platform's Meshimize tool rather than by this skill, so absence of declared secrets is expected.
Persistence & Privilege: okFlags show no 'always: true' and no requests to modify other skills or system-wide settings. The skill relies on operator approval for joins, limiting autonomous escalation risk.