Back to skill
Skillv0.1.0
ClawScan security
Epistemic Hygiene · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 1:02 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's instructions, files, and requirements are coherent with its stated purpose (teach and apply 'epistemic hygiene' during product/strategy/research conversations); it is instruction-only, asks for no credentials or installs, and contains no hidden endpoints or surprising privileges.
- Guidance
- This skill is instruction-only and internally consistent: it asks the agent to apply epistemic-guardrail behaviors and to run live searches before making external-state claims. Before installing, confirm two operational details with your platform: (1) whether the agent has safe web/arXiv/GitHub search capability (and how searches handle or redact any user data you supply), and (2) that you want the skill to auto-activate based on the trigger heuristics (it will apply silently unless you steer it). There are no credential requests or install actions in the bundle, so the primary checks are operational (search capability and activation behavior), not secrets or downloads.
Review Dimensions
- Purpose & Capability
- okName, description, README, SKILL.md and reference/example files consistently implement an epistemic-discipline for AI conversations. The skill requests no binaries, env vars, or config paths that would be unrelated to its purpose.
- Instruction Scope
- noteSKILL.md instructs the agent to run live web/GitHub/arXiv searches (2–3 angles) before asserting external-state claims and to apply eight internal principles silently. That behavior matches the stated goal, but it implicitly depends on the platform/agent having safe, appropriate web-search capability. If the hosting agent lacks web access the skill's core behavior will degrade; if web access exists, confirm how searches handle private data and which endpoints are used.
- Install Mechanism
- okNo install spec or code files to execute; this is an instruction-only skill with examples and docs. Nothing is downloaded or written to disk by the skill itself.
- Credentials
- okThe skill requires no credentials, no environment variables, and no config paths. The scope of requested access is minimal and proportionate to its stated function.
- Persistence & Privilege
- noteRegistry flags show normal defaults (always:false, disable-model-invocation:false). The README/SKILL.md describe automatic activation via trigger heuristics; this is consistent with user-invocable/autonomous invocation defaults but you should confirm you are comfortable with the agent autonomously applying the discipline when triggers match.