Back to skill
Skillv1.1.0
ClawScan security
Hebrew Nikud · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 11, 2026, 9:31 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- This is an instruction-only Hebrew nikud reference whose declared capabilities and requirements are consistent with its content; it requests no credentials, binaries, or installs and appears scoped to providing pronunciation/nikud guidance for TTS—but I could not verify the file's tail (truncated), so double-check the full SKILL.md before installing.
- Guidance
- This skill appears to be a straightforward Hebrew nikud reference and is low-risk because it contains no install steps, code, or credential requests. Before installing, review the complete SKILL.md (the excerpt provided here was truncated) to ensure there are no hidden instructions to call external services, read files, or access environment secrets. Also consider whether you trust the unknown source/owner (no homepage listed); prefer skills with a verifiable homepage or known author if you need long-term use. If you plan to let an agent apply nikud automatically, test outputs on non-sensitive sample text first because incorrect nikud harms TTS accuracy even when the skill itself is benign.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description (Hebrew nikud reference for TTS and pronunciation) match the provided SKILL.md content. It declares no binaries, env vars, or installs, which is appropriate for a textual reference.
- Instruction Scope
- okThe visible instructions are a language reference (rules, examples, verb paradigms) and do not direct the agent to read system files, access credentials, call external endpoints, or perform actions outside the stated purpose. They focus on when and how to add nikud for TTS. Note: the posted SKILL.md was truncated near the end, so I couldn't review the final portion of the file.
- Install Mechanism
- okNo install spec or code files are present. Instruction-only skills are the lowest-risk install mechanism; nothing will be written to disk or fetched during install.
- Credentials
- okThe skill requests no environment variables, secrets, or config paths. That is proportionate for a static language reference and raises no credential-exfiltration concerns.
- Persistence & Privilege
- okFlags are default (always: false, model invocation enabled). The skill does not request permanent presence or elevated privileges. Autonomous invocation is allowed by default but not, by itself, a red flag here.