Back to skill
Skillv1.0.0
ClawScan security
Kaomoji Manager · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 12, 2026, 1:40 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its description: small local Python utilities that read/write a local kaomojis.json and provide pick/list/save operations with no external network, credentials, or unusual installs.
- Guidance
- This skill appears safe and does what it says: choose, list, and save kaomojis in a local JSON file. Before installing, consider: (1) the Python scripts will overwrite kaomojis.json in the same folder—back up any existing file you care about; (2) running third-party scripts always carries risk, so inspect the files (already provided here) or run them in a restricted environment if you have concerns; (3) if you plan to integrate this into other tooling, confirm the working directory and file permissions to avoid accidental writes to unexpected locations.
Review Dimensions
- Purpose & Capability
- okName/description (kaomoji selector/storage) matches required files and code: scripts implement listing, picking by tags, and saving. No unrelated credentials, binaries, or config paths are requested.
- Instruction Scope
- okSKILL.md simply instructs running the provided Python scripts. The scripts only read/write the local kaomojis.json in the same directory and do not access other system files, environment variables, or external endpoints.
- Install Mechanism
- okNo install spec; this is instruction-only with accompanying Python scripts. No downloads, package installs, or archive extraction are performed by the skill.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths. The code operates on a single local JSON file, which is proportionate to the stated purpose.
- Persistence & Privilege
- okalways is false and the skill does not request persistent platform privileges. It only modifies its own kaomojis.json file in its directory and does not alter other skills or system-wide settings.