Back to skill
Skillv1.0.1
ClawScan security
Website Screenshot (By ScreenshotOne) · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 9, 2026, 7:25 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it documents using curl with a single ScreenshotOne access key and does not request unrelated credentials or install code on disk.
- Guidance
- This skill appears to do what it claims: use curl plus your ScreenshotOne access key to take screenshots. Before installing or using it: (1) Only provide your SCREENSHOTONE_ACCESS_KEY if you trust screenshotone.com and the key's scope; treat the key like any API secret and rotate it if exposed. (2) Be careful when using options that include cookies, authorization headers, scripts, or storage (store=true/storage_endpoint) — those can cause sensitive site data or screenshots to be sent/stored externally. (3) Do not paste other secrets into the command (cookies, tokens, or headers) unless you intend those to be transmitted to the ScreenshotOne API. (4) If you need screenshots of sensitive sites, review ScreenshotOne's documentation about storage and retention. Overall the skill is coherent and low-risk, but use caution with parameters that can leak data.
Review Dimensions
- Purpose & Capability
- okName and description match the actual requirements: curl and an access key (SCREENSHOTONE_ACCESS_KEY) are exactly what a direct HTTP-based screenshot skill needs. No unrelated binaries or secrets are requested.
- Instruction Scope
- noteSKILL.md contains concrete curl templates and stays within the stated purpose. However, the included options reference powerful parameters (cookies, authorization, scripts, proxy, storage) that—if used—can cause you to send sensitive data or upload results to remote storage; the skill itself does not instruct the agent to read other files or env vars, but users/agents could include other secrets in requests if careless.
- Install Mechanism
- okInstruction-only skill with no install spec and no files that execute code. This is the lowest-risk install model.
- Credentials
- okOnly one environment variable (SCREENSHOTONE_ACCESS_KEY) is required and declared as the primary credential. That is proportionate for an API-key-based screenshot service. The key is sensitive and should be treated as such.
- Persistence & Privilege
- okSkill is not always-enabled and does not request persistence or modify other skills or system settings. Autonomous invocation is allowed by default but is not combined here with broad credential or system access.