Skillv1.0.0

ClawScan security

Lobster Agent Summary · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 4, 2026, 11:23 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's requests and runtime instructions are consistent with its stated purpose of producing short periodic summaries of child agents' progress.
Guidance: This skill appears coherent and low-risk: it only reads the list of subagents and each subagent's recent session messages to make short summaries. Before installing, confirm that (1) your platform's subagents and sessions_history APIs provide only the data you expect and respect access controls and retention policies, (2) reusing parent-agent context is acceptable for privacy in your environment (it may expose additional conversation context), and (3) the 30s polling cadence is acceptable for rate limits and cost. If summaries might include sensitive strings, consider adding redaction/filtering or reducing what session history is fetched.

Purpose & Capability: okName/description ask for periodic short summaries of sub-agents; SKILL.md only requires listing subagents and fetching recent session history — these capabilities match the stated purpose.
Instruction Scope: noteInstructions are narrowly scoped to calling subagents list and sessions_history(sessionKey, limit=2) and generating 3–5 word summaries every ~30s. Minor note: guidance to 'reuse parentAgent context' could broaden what context is consulted — acceptable for caching/performance but may increase exposure to additional conversation context if not carefully limited.
Install Mechanism: okInstruction-only skill with no install steps or code files — lowest-risk install footprint.
Credentials: okNo environment variables, credentials, or unrelated config paths requested. The declared requirement for subagents and sessions_history is proportional to the stated function.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request permanent/force-included presence or system-wide config changes.