Back to skill
Skillv1.0.1
ClawScan security
IoT Platform Connection · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 4, 2026, 2:47 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- An instruction-only guide for connecting a local Claude/MCP client to an OpenClaw gateway; the instructions, file paths, and tooling referenced are consistent with the described purpose and there are no unexpected credential or network exfiltration steps.
- Guidance
- This appears to be a straightforward configuration guide. Before installing or invoking the skill: 1) Confirm you trust the OpenClaw source (homepage and source are not provided in the registry metadata). 2) Back up any files you may edit (e.g., ~/.claude/settings.json and ~/.openclaw/gateway.yaml) before applying changes. 3) Be cautious if you expose the gateway publicly (Tailscale funnel) — use strong passwords and understand the access implications. 4) If you allow the agent to invoke the skill autonomously, review any future runtime instructions the agent receives so it won't modify configs or read local files without your consent.
Review Dimensions
- Purpose & Capability
- okThe name/description promise to teach connecting to the OpenClaw MCP gateway; SKILL.md only references local gateway health checks, configuring Claude Code settings, Tailscale for remote access, and OpenClaw CLI/systemd commands. These requirements align with the stated purpose.
- Instruction Scope
- okRuntime instructions are limited to verifying gateway health (curl), editing/adding mcpServers entries in Claude settings, checking systemd/journalctl, and using OpenClaw CLI. It references local config files (~/.claude/settings.json and ~/.openclaw/gateway.yaml) which is appropriate for configuration tasks and does not instruct broad file system access or sending arbitrary data to third parties.
- Install Mechanism
- okThere is no install spec and no code files; this is instruction-only, so nothing will be written to disk by the skill itself. That is proportionate and lower risk for this type of guide.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The only sensitive item mentioned is a gateway password stored in ~/.openclaw/gateway.yaml, but the doc only advises ensuring configuration matches — it does not request external secrets or unrelated credentials.
- Persistence & Privilege
- okalways is false, there is no installation or background persistence requested, and the skill does not ask to modify other skills or global agent settings. Autonomous invocation is allowed by default but the guide itself does not require elevated privileges.