Back to skill
Skillv3.0.0
ClawScan security
Translator Pro Test · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 19, 2026, 2:23 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose (local translation testing helper); it runs a local shell script, creates a per-user data directory, and does not request credentials, network access, or install external code.
- Guidance
- This skill appears coherent and low-risk: it runs only the included shell script and creates a folder under your home directory. The script prints canned responses and does not call the network or require credentials. Notes before installing: 1) the script writes to ~/.local/share/translator-pro-test (check that you are okay with that directory being created). 2) The script contains minor bugs/quirks (many echo lines use single quotes so variables are not expanded and some messages are placeholder-like), which affect functionality but are not a security risk. 3) If you want maximum caution, inspect scripts/script.sh yourself or run the skill in a sandboxed account before using it with sensitive data.
Review Dimensions
- Purpose & Capability
- okName/description (translation testing with dictionaries/comparisons) matches what is provided: an instruction-only skill that invokes scripts/script.sh to perform test, dict, compare, glossary, quality, and batch operations. There are no unrelated credentials, binaries, or services requested.
- Instruction Scope
- okSKILL.md instructs the agent to run the bundled scripts/script.sh with specific subcommands. The script only creates a per-user data directory (~/.local/share/translator-pro-test) and prints responses; it does not read unrelated system files, environment variables, or transmit data externally.
- Install Mechanism
- okThere is no install spec; this is an instruction-only skill with one bundled script. Nothing is downloaded or extracted from external URLs, and no packages are installed.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths beyond creating a local data directory. No sensitive secrets are required or referenced.
- Persistence & Privilege
- okalways is false (default). The skill only creates and uses its own per-user data directory; it does not attempt to modify other skills, global agent settings, or request permanent elevated presence.