Back to skill
Skillv1.0.1
ClawScan security
Design To Code · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 20, 2026, 6:56 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only Design→Code helper whose requested resources and runtime instructions are consistent with its stated purpose and do not ask for unrelated credentials or installs.
- Guidance
- This skill appears coherent and low-risk: it only contains step-by-step guidance for converting designs to frontend code and asks users to provide design assets or existing project code when necessary. Before using it, avoid pasting secrets or private tokens into messages; grant only the minimal access needed (for example, Figma view links or a code snippet rather than entire private repos) and confirm whether the agent will make commits or only generate code snippets. If you need the agent to use a Figma API token or push to a repository, treat those actions as separate and supply credentials through secure channels only when you explicitly intend that behavior.
Review Dimensions
- Purpose & Capability
- okName/description (convert Figma/Sketch/images to frontend code) matches the SKILL.md: the instructions focus on analyzing designs, extracting sizes/colors/typography, and producing front-end components. No unrelated services, binaries, or credentials are requested.
- Instruction Scope
- okRuntime instructions are scoped to reading provided design assets and, if the user supplies it, existing project code to align tokens/tech stack. The skill does not instruct the agent to read unrelated system files, environment variables, or transmit data to unexpected endpoints. It does ask to inspect 'existing code' when provided, which is appropriate for this task.
- Install Mechanism
- okNo install spec or code files — purely instruction-only. That minimizes disk writes and arbitrary code execution risk.
- Credentials
- okNo environment variables, credentials, or config paths are required. The instructions mention Figma/Sketch links and asking about access permissions, but do not request API tokens or other secrets.
- Persistence & Privilege
- notealways is false (good). The skill allows normal autonomous invocation (platform default). When invoked autonomously it may read user-supplied project files to determine tech stack — this is expected for the task but users should be aware and only provide repos/designs they consent to share.