Back to skill
Skillv1.1.0
ClawScan security
Semantic Hub · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 6, 2026, 8:36 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions match its stated purpose (scoped API access to a project-management REST API) and there are no install or secret-exfiltration patterns in the package, but verify the API-key scope and publisher before use.
- Guidance
- This skill appears to be internally consistent: it only needs a board-scoped API key and instructs the agent to call documented endpoints. Before installing: 1) Verify the publisher and the dashboard URL (https://dashboard.simplysemantics.com) and confirm you trust the service. 2) Only provision API keys scoped to the specific board(s) the agent should access — avoid giving organization- or admin-level keys. 3) Do not upload sensitive files or secrets via the skill until you have validated the service's handling and storage policies; test with non-sensitive data first. 4) Rotate/revoke the API key if you stop using the skill or suspect misuse. 5) If you require higher assurance, ask the publisher for an audited security/PRIVACY policy or run a traffic inspection to confirm requests only go to the stated endpoints.
Review Dimensions
- Purpose & Capability
- okName/description (project management for Human+AI) align with the declared requirement of a single SEMANTIC_HUB_API_KEY and the SKILL.md REST endpoints. There are no unrelated credentials, binaries, or excessive permissions requested.
- Instruction Scope
- noteSKILL.md instructions are narrowly scoped to calling the documented dashboard.simplysemantics.com/hub REST endpoints using the SEMANTIC_HUB_API_KEY. The skill explains file upload endpoints and when agents may upload/attach files. Vendor privacy claims ("No user PII...ever transmitted") are strong assurances in prose — users should treat them as vendor statements to verify rather than technical enforcement by the skill itself.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — nothing is written to disk or downloaded during install, which is the lowest-risk model.
- Credentials
- okOnly one required environment variable is declared (SEMANTIC_HUB_API_KEY) and it is the expected credential for the documented API. No other secrets or system paths are requested.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system-level privileges or to modify other skills. Autonomous invocation is permitted (platform default) but is not combined with broad credentials or unusual privileges.