Skillv1.2.0

ClawScan security

Military PCS Optimizer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

SuspiciousFeb 26, 2026, 1:16 PM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's instructions are coherent for a PCS calculator and require no special permissions, but the author/source is unverified, premium content is sold via an external link, and there is no declared data provenance or rate tables — so accuracy and trustworthiness are unclear.
Guidance: This skill looks technically coherent (no installs or secrets requested), but there are trust and accuracy concerns you should consider before using it: 1) Source is unknown — the author’s claim of being an active-duty service member is unverifiable from the package. 2) The skill advertises paid premium rate tables and calculators via an external Gumroad link; be cautious about paying and sharing payment or personal data with an unverifiable third party. 3) No authoritative data sources or rate tables are bundled or cited — treat calculated entitlements as estimates and verify with official resources (local finance/transportation office, DFAS, service PCS regs). 4) Avoid entering sensitive PII (SSN, banking credentials, full orders) into the skill’s prompts. If you need high-stakes or exact entitlement figures, consult official channels or verified tools. If you want to install/use it, ask the publisher for provenance (who maintains the rate tables and when they were last updated) and for a privacy statement about what the skill sends or stores.

Purpose & Capability: noteThe name/description (PCS entitlements, timeline, money-maximization) align with the provided SKILL.md instructions. The skill is instruction-only and requests no binaries, installs, or credentials — which is proportionate. However, it advertises 'premium rate tables' and specialized calculators without bundling or documenting the authoritative data sources used for calculations.
Instruction Scope: okSKILL.md instructs the agent to gather user-provided PCS details (branch, rank, dependents, origin/destination) and produce calculations, timelines, and advice. It does not direct the agent to read local files, environment variables, or system configuration, nor to send data to unexpected endpoints in the instructions themselves.
Install Mechanism: okNo install spec or code is present; this is lowest-risk instruction-only behavior. Nothing will be written to disk or fetched at install time according to the manifest.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. That matches the described functionality and is proportionate.
Persistence & Privilege: okalways:false and no special privileges are requested. The skill does not request persistent system presence or modify other skills/configurations.