Back to skill
Skillv1.0.2010
ClawScan security
celo-composer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 2:50 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only scaffold for Celo dApps that only tells the user how to run npx to create projects and how to configure local .env files; its requirements and instructions are consistent with that purpose.
- Guidance
- This appears to be a straightforward scaffolding guide, but note: npx executes code fetched from the npm registry — inspect or pin the @celo/celo-composer package (check its repository, maintainer, and release) before running. Treat PRIVATE_KEY and other secrets as sensitive: never commit .env files to source control (add them to .gitignore), consider using a secret manager for deployments, and audit the generated project's dependencies and scripts before running build/deploy commands. If you want extra safety, create the project in an isolated environment (VM or container) and review the scaffolded files before installing or running any scripts.
Review Dimensions
- Purpose & Capability
- okName/description match the content: the SKILL.md documents how to scaffold Celo projects using npx @celo/celo-composer. The skill requests no credentials, binaries, or config paths beyond what a scaffolding guide would reasonably mention.
- Instruction Scope
- okInstructions are limited to running npx create, running local build/test commands, and creating project-local .env files. The skill does not instruct the agent to read host system files, exfiltrate data, or call unexpected external endpoints beyond normal blockchain RPC endpoints and package registries used by the templates.
- Install Mechanism
- noteNo install spec — instruction-only. The guide recommends using npx to fetch @celo/celo-composer from npm, which is expected for a scaffolding tool but carries the normal risk that npx executes code downloaded from the npm registry; users should prefer pinned versions or review package source before running.
- Credentials
- okThe skill itself requires no environment variables or credentials. The documentation advises creating project-local env vars (NEXT_PUBLIC_WC_PROJECT_ID, ALCHEMY key, PRIVATE_KEY, CELOSCAN_API_KEY) which are appropriate for dev/deploy workflows—these are for the generated project, not for the skill runtime.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request persistent privileges or modify other skills or system settings. Autonomous invocation is allowed (platform default) but the skill content poses no additional privilege concerns.