Skillv1.0.0

ClawScan security

Nine Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 18, 2026, 2:25 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only productivity tool whose requested permissions and behavior are coherent with its stated purpose (timers, task categorization, and simple math helpers).
Guidance: This appears coherent and low-risk: it only needs time/notification permissions which make sense for a timer. Before installing, confirm you trust the (opaque) publisher/owner ID and note the registry metadata lists no homepage while SKILL.md references a ClawHub URL — if provenance matters, verify the publisher. Also review any runtime permission prompts for system notifications and time access if your platform shows them.

Purpose & Capability: okThe name/description (9-minute timer, 9-level prioritization, math tricks, 9-category organization) match the SKILL.md instructions. Declared permissions (system.time, system.notification) are appropriate for a timer/notification feature. There are no unrelated binaries, env vars, or config paths requested.
Instruction Scope: okSKILL.md contains only user-facing instructions and examples for timers, categorization, and simple arithmetic; it does not instruct reading files, scanning system state, accessing unrelated environment variables, or transmitting data to third parties.
Install Mechanism: okNo install spec and no code files are present (instruction-only). This is low-risk: nothing will be written to disk or downloaded during installation.
Credentials: okNo environment variables, credentials, or config paths are required. The skill does not request secrets or access that would be disproportionate to its stated functionality.
Persistence & Privilege: okalways is false (not force-included) and model invocation is allowed (the platform default). The skill does not request persistent system-level changes or access to other skills' configs.