Back to skill
Skillv2.0.3
ClawScan security
License · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 24, 2026, 12:43 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a local reference tool that outputs static license-related documentation and its files, requirements, and behavior are consistent with that purpose; only minor documentation/version mismatches were found.
- Guidance
- This skill is a simple, local reference tool that prints static documentation. Before installing/using: (1) note minor non-security issues — the script's VERSION value (2.0.2) doesn't match the registry metadata (2.0.3) and the help heredoc is quoted such that $VERSION won't expand; (2) the quickstart text mentions "access credentials" but the skill otherwise needs no credentials — treat that as leftover template wording; (3) the script performs only read-only output (no network, no writes) but you can review/run it in a sandbox if you want extra assurance. Overall the package is coherent with its stated purpose and presents low risk.
Review Dimensions
- Purpose & Capability
- okName/description promise a devtools reference; the included script simply prints static reference text for the listed commands. No network calls, no external binaries or credentials are required, which is proportionate to a reference tool.
- Instruction Scope
- noteSKILL.md claims all outputs are plain-text heredocs with no external API calls or credentials; the bundled script follows that (it only uses cat/echo/case). Minor inconsistencies in the documentation: the quickstart text mentions "Required tools and access credentials" which contradicts the 'no credentials required' claim, and the help heredoc is single-quoted so the $VERSION variable will not be expanded (small implementation bug, not a security issue).
- Install Mechanism
- okThere is no install spec (instruction-only plus a simple shell script). Nothing is downloaded or extracted; no installer or remote fetch is defined.
- Credentials
- okThe skill declares no required environment variables, no credentials, and the script does not read environment variables or configuration paths. Requested access is minimal and matches the skill's function.
- Persistence & Privilege
- okalways:false and user-invocable:true (defaults). The skill does not request persistent presence or modify agent/system configurations. Autonomous invocation is allowed by platform default but combined with the minimal footprint this is not concerning.