Back to skill
Skillv1.0.0
ClawScan security
Azure Global Search · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 21, 2026, 9:03 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent: it is an instruction-only Azure product information helper that uses public docs and search queries and does not request credentials or install anything.
- Guidance
- This skill is an instruction-only helper that gathers Azure product info from public Microsoft pages and docs; it does not ask for or store credentials. Before installing, note: (1) the skill may suggest CLI/SDK commands (e.g., az login, DefaultAzureCredential) for users who want to act on resources — those require your Azure credentials and are not performed by the skill itself; do not paste secrets into chat. (2) The agent may fetch and summarize public pages from learn.microsoft.com and azure.microsoft.com — if you need stricter network controls, avoid invoking it. If you see any step that asks you to provide sensitive tokens or to run commands you don't recognize, stop and verify the source.
Review Dimensions
- Purpose & Capability
- noteThe name/description match the implementation: the SKILL.md directs the agent to search official Azure product pages and docs. Minor inconsistency: the description emphasizes 'without login' while example quickstarts and SDK snippets show commands (az login, DefaultAzureCredential, subscription-id) that require authentication — those are example usage for users who perform actions themselves, not required by the skill.
- Instruction Scope
- okInstructions are limited to identifying product keywords, constructing site: search queries, locating official pages (azure.microsoft.com, learn.microsoft.com), and summarizing documentation. The skill does not instruct reading local files, secrets, or sending data to third-party endpoints.
- Install Mechanism
- okNo install spec and no code files — instruction-only. Nothing will be written to disk or downloaded by the skill itself.
- Credentials
- noteThe skill declares no required environment variables or credentials, which is appropriate. The examples include placeholders (subscription-id, admin-password) and show CLI/SDK commands that require auth if you or the user run them; those are illustrative and not requested by the skill itself.
- Persistence & Privilege
- okThe skill does not request persistent presence (always:false) and does not modify other skills or system configuration.