Skillv1.0.0

ClawScan security

SKILL.md · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 16, 2026, 4:29 PM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only social media/lead-generation writing skill and its declared requirements and instructions are consistent with that purpose.
Guidance: This skill appears coherent and low-risk: it only contains instructions for generating marketing text and requests no secrets or installs. Before using it in production, review any generated copy for accuracy, brand/legal compliance, and to avoid posting sensitive or personally identifiable information. If you plan to connect this to ad accounts or email providers, expect those integrations to require separate, explicit credentials — none are requested by this skill. If you want stricter control, only enable the skill when you need it and review outputs before publishing.

Purpose & Capability: okName and description match the skill content: it generates posts, captions, follow-ups, ad suggestions and sales scripts. It declares no external credentials, binaries, or installs, which is proportionate for a copywriting/marketing assistant.
Instruction Scope: okSKILL.md contains only guidance for producing marketing copy and strategy; it does not instruct reading system files, accessing environment variables, contacting external endpoints, or exfiltrating data.
Install Mechanism: okNo install spec and no code files are present (instruction-only), so nothing is written to disk or fetched during install — lowest-risk setup.
Credentials: okNo environment variables, credentials, or config paths are requested; this matches the skill's stated functionality (text generation only).
Persistence & Privilege: okSkill is not force-included (always: false) and does not request persistent system-wide changes or other skills' configs. Default autonomous invocation is allowed but unsurprising for such a skill.