Skillv1.0.0

ClawScan security

Email Sequence Builder · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 13, 2026, 12:34 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only email copywriter that only generates and saves marketing sequences and does not request credentials or install code; its declared requirements align with its stated purpose.
Guidance: This skill appears coherent: it only generates email sequences and writes template files. Before installing, verify the complete SKILL.md (the quality-checks were truncated here) and confirm the agent's tooling permissions — the skill lists allowed-tools like Read/Write/Edit/Bash, which permit filesystem and shell access. Even though the skill itself doesn't request secrets or network access, granting broad tools to any skill increases risk; if you want extra caution, run it in a sandboxed agent or restrict it to only Read/Write (no shell) unless shell access is necessary. If you need assurance it won't send emails or contact external services, confirm there are no additional instructions or hidden files that call external endpoints.

Purpose & Capability: okName and description (email marketing sequences) match the SKILL.md content. There are no unexpected required binaries, environment variables, or config paths declared that would be unrelated to generating and saving email copy.
Instruction Scope: okSKILL.md limits behavior to generating email content, producing platform-ready outputs (Markdown, CSV, plain text), and saving files in an output/ directory. It does not instruct the agent to read system config, access credentials, or call external endpoints. (Note: the document is truncated at the end of the quality-check list — review the full SKILL.md to confirm there are no additional steps.)
Install Mechanism: okNo install spec and no code files — nothing is downloaded or written as part of an installer. This is the lowest-risk model (instruction-only).
Credentials: okThe skill declares no environment variables, no credentials, and no config paths. That is proportionate for an email content generator which only needs to output files and templates.
Persistence & Privilege: okalways is false and the skill does not request permanent presence or modify other skills or system-wide settings. It does instruct saving files in an output path, which is reasonable for its purpose.