Skillv1.0.0

ClawScan security

apple-search-adser · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 12, 2026, 1:37 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This instruction-only Apple Search Ads consultant skill is internally consistent with its stated purpose and does not request credentials, install software, or perform unexpected actions.
Guidance: This skill is an instruction-only Apple Search Ads consultant and appears coherent and proportionate: it asks for campaign details and then uses its built-in reference documents to advise. It does not request credentials or install software. Before using it, avoid pasting any account credentials or private tokens into chat; instead share only the campaign metrics (CPA, TTR, CR, budgets) the skill needs. Note the skill's publisher/homepage are not provided — if provenance matters to you, prefer skills from known publishers or verify the publisher ID in the registry. Finally, the skill can run autonomously by default (normal for skills), so if you prefer to approve each invocation, disable autonomous use in your agent settings.

Purpose & Capability: okName, description, and included reference files all focus on Apple Search Ads workflow (campaigns, keywords, bidding, metrics). There are no unrelated environment variables, binaries, or install steps requested — the required surface is proportional to an ASA specialist skill.
Instruction Scope: okSKILL.md limits actions to interactive diagnosis and loading local reference files on user confirmation. It instructs the agent to extract campaign context from the user's message and to ask focused follow-ups when needed. It does not direct reading of system files, environment variables, or transmitting data to external endpoints.
Install Mechanism: okNo install spec and no code files to execute; this is instruction-only. That is the lowest-risk install profile and matches the skill's purpose.
Credentials: okThe skill declares no required environment variables, no primary credential, and no config paths. All recommendations operate on user-provided campaign metrics and the skill's internal reference docs.
Persistence & Privilege: okalways:false and no install behavior means the skill does not request elevated or permanent presence. It does not modify other skills or system-wide settings.