Back to skill
Skillv1.3.0
ClawScan security
Shike Darwin Optimizer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 15, 2026, 12:26 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (autonomous optimization of SKILL.md files) matches its runtime instructions (scan skills, propose/edit SKILL.md, run baseline/with-skill tests, git commit/revert), with minor documentation/install mismatches you should review before running.
- Guidance
- This skill is internally consistent for the stated job of optimizing SKILL.md files, but it will read and edit all local skill SKILL.md files and spawn subagents to test changes. Before running: (1) back up your skills directory or work in a clone; (2) verify you trust the author/package if you follow the README's npx / zip links (they're not part of the registry install in this package); (3) ensure you want automated git commits/reverts (and be prepared for any remote push to require your credentials); (4) confirm that you will approve the human-confirm checkpoints rather than giving blanket consent. If you'd like, I can list the exact file and git operations the SKILL.md will perform so you can review them line-by-line.
Review Dimensions
- Purpose & Capability
- okThe name/description claim an autonomous optimizer for agent skills; the SKILL.md instructs scanning SKILL.md files, designing test-prompts, running baseline vs with-skill tests, editing SKILL.md, and using git to commit/revert — all coherent with an optimizer whose asset is SKILL.md.
- Instruction Scope
- noteRuntime instructions explicitly read and write local skill files (e.g., .claude/skills/*/SKILL.md), create/modify test-prompts.json and results.tsv, and spawn subagents to run tests. These actions are necessary for the stated purpose, but they give the skill broad ability to modify your local skill repository — ensure you want an automated process that can edit SKILL.md files and run child agents. The SKILL.md does include human-confirmation checkpoints before evaluation/edits/keep-or-revert.
- Install Mechanism
- noteRegistry entry is instruction-only (no install spec) so nothing is automatically downloaded/installed. README suggests optional install routes (npx package name and a zip URL hosted on an r2.dev domain). That external-install guidance is not reflected in the registry metadata and represents an out-of-band installation option you should validate before using (verify publisher, package contents and URL).
- Credentials
- okThe skill requests no environment variables or credentials in metadata. The instructions rely on local Git and the agent platform's ability to spawn child agents and access local skill files; those are proportionate to an optimizer. Note: the skill may cause network activity indirectly when subagents run or if you choose to push commits; such networking/credential usage is not declared (e.g., remote git push), so be prepared to handle prompts or credential use yourself.
- Persistence & Privilege
- okalways:false and default model-invocation settings are fine. The skill writes local artifacts (results.tsv, test-prompts.json) and performs git commits/reverts within the skills repo — that is expected for its function. It does not request forced global persistence or modify other skills' configurations beyond editing their SKILL.md files (which is the stated goal).