Back to skill
Skillv1.0.1
ClawScan security
Vvvv Spreads · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 5, 2026, 10:43 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- An instruction-only coding helper for vvvv gamma Spread<T> patterns; the skill is internally consistent, requires no credentials or installs, and contains only example code and guidance.
- Guidance
- This is an instruction-only helper with code examples for vvvv gamma Spread<T>. It asks for no credentials and installs nothing, so there is no direct exfiltration or install risk. Things to consider before enabling: (1) the skill may trigger automatically when you or your agent mention lists/arrays unless you restrict autonomous invocation — disable autonomous use if you want manual control; (2) verify the patterns and edge cases against your vvvv gamma version and build/test generated code in a safe environment; (3) note the minor version mismatch between the registry (1.0.1) and SKILL.md (1.1) — this is likely cosmetic but worth confirming if provenance/version tracking matters to you; and (4) the content is licensed CC-BY-SA-4.0, so reuse of examples should follow that license.
Review Dimensions
- Purpose & Capability
- okName, description, and included files are consistent: the skill provides guidance and code snippets for vvvv gamma's Spread<T> and SpreadBuilder<T>. It does not request extra binaries, credentials, or unrelated capabilities. Minor metadata mismatch: SKILL.md lists version "1.1" while registry metadata shows 1.0.1 (likely bookkeeping, not a security issue).
- Instruction Scope
- noteSKILL.md contains only documentation and C# example code for Spread usage and performance tips. It instructs agents to apply the skill whenever collection-processing C# code appears (including generic terms like 'list' or 'array'), which broadens when the skill might be triggered but stays within the coding-assistant domain. There are no instructions to read files, access environment variables, or contact external endpoints.
- Install Mechanism
- okNo install spec and no code files beyond examples and documentation. This is low risk because nothing is downloaded or written to disk by the skill itself.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. SKILL.md does not reference any secrets or external service tokens.
- Persistence & Privilege
- noteFlags are defaults (always: false, user-invocable: true, disable-model-invocation: false). Autonomous invocation is permitted by default on the platform; combined with this skill's narrow scope and lack of sensitive access, that is acceptable. If you prefer the agent not to trigger it automatically when mentioning generic collection terms, consider disabling autonomous invocation or only invoking the skill explicitly.