Back to skill
Skillv1.0.1
ClawScan security
Info Visualize · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 14, 2026, 3:57 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requirements are consistent with a chart/report rendering utility; no surprising network calls, credential requests, or persistence privileges were found—only platform assumptions and minor bugs.
- Guidance
- This skill appears to do what it says (render SVG or PNG reports). Before installing or using it: 1) Note PNG rendering requires Pillow—use a virtualenv or test install in an isolated environment. 2) The code prefers Windows fonts under C:\Windows\Fonts; on Linux/macOS you may need to install or point it to appropriate TTF files. 3) Archiving/copying behavior is opt-in (via CLI flag); review the path you pass to --archive to avoid writing outputs into sensitive directories. 4) There are some minor code issues (e.g., an internal function references math without a top-level import) which may cause runtime errors in some paths—test with sample JSON before automating. 5) No network calls or secret exfiltration were found, but as with any code from an unknown source, review the scripts yourself if you need higher assurance.
Review Dimensions
- Purpose & Capability
- okName/description (render SVG and PNG long-form reports) lines up with the provided scripts and SKILL.md. The PNG renderer depends on Pillow (documented); the SVG script uses only the standard library. No unrelated credentials, binaries, or services are requested.
- Instruction Scope
- noteSKILL.md and the scripts stay within the stated purpose: they load JSON data, render SVG/HTML or PNG images, and optionally copy outputs to an archive folder. The README suggests copying to paths like a user .ai-memory folder as an example; the archive behavior is opt-in via a CLI flag rather than automatic. The skill does reference local font files (C:/Windows/Fonts) and includes a WorkBuddy watermark in outputs (intentional branding).
- Install Mechanism
- okNo install spec (instruction-only) and no network downloads in code. The only runtime dependency is Pillow for PNG output (documented). This is a low-risk install profile.
- Credentials
- okThe skill requests no environment variables or credentials. It accesses local filesystem paths for fonts and accepts an optional archive path provided by the user. Those filesystem accesses are proportionate to producing output images.
- Persistence & Privilege
- okalways:false and no mechanism to register or persist itself into the agent environment. The skill does not modify other skills or global agent configs; archive/copy is an explicit, user-specified action.