Back to skill
Skillv1.0.0
ClawScan security
Web Research Assistant · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 14, 2026, 6:07 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only “web research” workflow that is internally consistent with no unexpected installs, credentials, or file access requested.
- Guidance
- This skill is instruction-only and internally consistent, so it poses low installation risk. Before you rely on outputs: (1) confirm your agent has safe, audited web-browsing/search capability (the skill assumes the agent can access the web); (2) avoid pasting secrets or private data into queries — the skill will synthesize and cite anything you provide; (3) verify citations and URLs the model returns (LLMs can hallucinate plausible-sounding sources or dates); (4) if you need authoritative coverage, specify allowed domains or time ranges in your prompt; and (5) run a few harmless test queries to confirm the quality and provenance of results before using it for sensitive decisions.
Review Dimensions
- Purpose & Capability
- okName and description match the actual requirements: it's an instruction-only research workflow that asks the agent to formulate queries, search sources, evaluate credibility, synthesize, and cite. There are no unrelated env vars, binaries, or config paths requested.
- Instruction Scope
- noteSKILL.md provides high-level, non-invasive instructions for conducting web research and source evaluation. It does not instruct the agent to read local files, environment variables, or transmit data to unexpected endpoints. Because the guidance is broad ("search across multiple sources"), actual behavior depends on the agent/platform browsing/search capabilities and any runtime safety policies; the instructions lack constraints (allowed/forbidden domains, privacy handling) which is a functional/usability note rather than an incoherence.
- Install Mechanism
- okNo install spec and no code files — lowest-risk arrangement. Nothing is downloaded or written to disk by the skill itself.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths. Requested access is minimal and proportional to its stated purpose.
- Persistence & Privilege
- okalways:false and no indications the skill modifies agent/system settings or other skills. Autonomous invocation is allowed by default but is not combined here with any broad credentials or persistence, so no elevated privilege concerns.