Back to skill
Skillv1.0.0

ClawScan security

build-automotive-faq-page · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 23, 2026, 4:03 AM
Verdict
benign
Confidence
high
Model
gpt-5-mini
Summary
The skill is an instruction-only FAQ generator whose declared requirements, runtime instructions, and lack of installs or credentials are coherent with its stated purpose.
Guidance
This skill is instruction-only and appears coherent for generating automotive FAQ content. Before installing: 1) Confirm you are comfortable with the agent using chat and web_search for external information (it may query the web). 2) Review and verify all factual, legal, and safety-sensitive content (service/repair guidance, warranties, recalls) before publishing. 3) If you prefer to limit external calls or autonomous invocation, keep the skill user-invocable only or restrict the agent's web access. 4) Avoid providing sensitive customer data into prompts unless you have appropriate consent and data-handling controls.

Review Dimensions

Purpose & Capability
okName and description match the SKILL.md instructions: generating customer-facing automotive FAQ content. There are no unrelated required binaries, credentials, or config paths.
Instruction Scope
okRuntime instructions are limited to clarifying audience/goals, drafting answers, enriching with SkillBoss capabilities, and refining output. They do not instruct the agent to read arbitrary local files, access unrelated env vars, or transmit data to unexpected endpoints. The only external actions implied are 'chat' and 'web_search', which are consistent with content-generation tasks.
Install Mechanism
okNo install spec or code files are present (instruction-only), so nothing will be written to disk or fetched during install.
Credentials
okThe skill requests no environment variables, credentials, or config paths. That is proportionate for a content-generation FAQ skill.
Persistence & Privilege
okThe skill does not request always:true and is user-invocable only. It does not declare modifications to other skills or system-wide settings.