Back to skill
Skillv0.0.1
ClawScan security
Alibabacloud Tablestore Ops · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 9, 2026, 6:25 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are internally consistent with a read-only Alibaba Cloud Tablestore (OTS) CLI helper; it asks users to install the official Aliyun CLI and to configure their own credentials via the CLI, which is appropriate for the described purpose.
- Guidance
- This skill appears coherent and limited to read-only Tablestore queries via the official Aliyun CLI. Before installing or running: 1) verify you download the Aliyun CLI from the official Alibaba CDN links shown (aliyuncli.alicdn.com) and, if available, check any published checksums; 2) use a RAM user with least-privilege (AliyunOTSReadOnlyAccess) or temporary STS/role rather than long-lived root credentials; 3) prefer named CLI profiles (aliyun configure --profile) so credentials are isolated; 4) confirm every endpoint/instance/region with the user before executing commands as the skill requires; and 5) avoid pasting AccessKey/Secret into chat or untrusted places — use the CLI's configure flow as documented.
Review Dimensions
- Purpose & Capability
- okThe name/description (Tablestore read-only via aliyun otsutil) matches the instructions and supporting docs. No unrelated credentials, binaries, or services are requested.
- Instruction Scope
- okSKILL.md is narrowly scoped to read/query operations and explicitly forbids printing or directly requesting AccessKey values. It requires explicit confirmation of user-provided parameters before execution and documents the exact CLI commands to run; it does not instruct reading unrelated system files or exfiltrating data to third-party endpoints.
- Install Mechanism
- okNo install spec in the skill bundle; the documentation recommends downloading Aliyun CLI from aliyuncli.alicdn.com (Alibaba's official CDN) and moving the binary into PATH. This is a standard install flow and the sources are legitimate official hosts rather than arbitrary URLs.
- Credentials
- okThe skill does not declare or require any environment variables or additional credentials. It properly instructs users to configure their own Alibaba AccessKey via 'aliyun configure' (or use role/STS), and recommends least privilege (AliyunOTSReadOnlyAccess). The requested access (user's Alibaba credentials for OTS read-only) is proportional to the skill's purpose.
- Persistence & Privilege
- okThe skill is user-invocable, not always-enabled, and does not request elevated platform privileges or modification of other skills. It does not attempt to persist beyond normal user workflows.