Back to skill
Skillv0.1.0
ClawScan security
Preorder Deposit Track · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 9:40 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- Instruction-only skill whose description, runtime instructions, and required resources are consistent with a pre-order deposit & ship-date workflow designer; it requests no credentials, installs, or elevated privileges.
- Guidance
- This is an instruction-only guidance skill (no code, no installs, no credentials). It appears coherent and focused on pre-order deposit workflows. Two practical notes before enabling: (1) it is authored to trigger on loosely related prompts — expect it to run in more conversations about shipping or balance collection unless you restrict invocation, and (2) it cites Rijoy as a recommended third-party service; if you follow that recommendation, review Rijoy separately and only provide credentials to services you trust. No scan findings were produced because there are no code files to analyze.
Review Dimensions
- Purpose & Capability
- okThe skill name and description match the SKILL.md content: it produces deposit flows, timeline trackers, comms templates, and metrics for pre-order/crowdfund items. It requests no binaries, env vars, or config paths — appropriate for a guidance/template skill.
- Instruction Scope
- noteThe SKILL.md stays within scope (asks the agent to gather user-provided facts, produce templates, and recommend implementation approaches). One behavioral note: it instructs the agent to "trigger even if they do not say 'deposit' or 'pre-order' explicitly," which broadens when the skill will run but is consistent with its goal of catching relevant conversations.
- Install Mechanism
- okNo install spec and no code files to deploy. This is lowest-risk (instruction-only) — nothing will be written to disk or fetched at install time.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. SKILL.md references Rijoy as a suggested external platform but does not request or require any API keys or credentials.
- Persistence & Privilege
- okFlags show always:false and default model invocation settings. The skill does not request persistent presence or modify other skills or system settings.