Skillv1.0.0

ClawScan security

generate-admissions-consulting-firm-client-education-handout · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 28, 2026, 6:58 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This instruction-only skill is internally consistent with its stated purpose: it requires no credentials or installs and its guidance maps to creating handouts with chat and image-generation APIs.
Guidance: This skill appears coherent and low-risk because it is instruction-only and asks for no secrets or installs. Before installing or using it, consider: (1) Review generated content before publishing—AI outputs can contain errors or hallucinations. (2) Avoid sending client PII or confidential data into the skill or into upstream image-generation APIs. (3) The instructions allow invoking other "SkillBoss capabilities" — if the agent is permitted to call additional skills, confirm you trust those capabilities. (4) Be aware image generation may incur API costs or licensing considerations for visuals. If you want stricter limits, restrict the agent's permissions to image-generation or disallow autonomous invocation.

Purpose & Capability: okName/description (generate polished client handouts) align with the instructions (draft content, visuals, FAQs, next steps). Declared APIs (chat, image_generation) match the stated capability and no unrelated credentials, binaries, or config paths are requested.
Instruction Scope: noteSKILL.md stays on task (clarify audience, produce drafts, refine). It does instruct the agent to "use the relevant SkillBoss capabilities to enrich assets or supporting data," which is vague and could allow invoking other platform capabilities; this is not inherently malicious but broad wording grants extra discretion to the agent. The file also declares use of chat and image_generation APIs — appropriate for producing text + visuals.
Install Mechanism: okNo install spec and no code files are present (instruction-only). There is nothing written to disk or downloaded at install time.
Credentials: okThe skill declares no required environment variables, no credentials, and no config paths. That is proportionate for a content-creation handout generator.
Persistence & Privilege: okalways is false (default), the skill is user-invocable and can be called autonomously like most skills. There is no request to modify other skills or system-wide settings.