Back to skill
Skillv3.0.0
ClawScan security
Unitconv · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 19, 2026, 10:41 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions are coherent with a simple unit-conversion utility and do not request credentials, network access, or other elevated privileges.
- Guidance
- This skill appears to be a straightforward unit converter with no network calls or credential usage. Before installing, verify how the script will be invoked in your agent environment (SKILL.md expects a `unitconv` command but the repository provides scripts/script.sh), and confirm the platform will place or wrap that script on PATH or otherwise call it safely in a sandbox. If you want extra assurance, open and review scripts/script.sh (already included) — it contains only simple arithmetic and unit mappings. There are no obvious signs of exfiltration or unrelated capabilities.
Review Dimensions
- Purpose & Capability
- okName/description (unit conversion) match the included script and SKILL.md. The script implements conversions for the listed unit categories with no unrelated functionality.
- Instruction Scope
- noteSKILL.md describes running a `unitconv` command and states it uses awk for math; the included scripts/script.sh implements the functionality and calls awk. There is a minor operational inconsistency: SKILL.md examples call `unitconv` but no install steps are provided to place scripts/script.sh on PATH as `unitconv`. This is an operational/usability note rather than a security concern.
- Install Mechanism
- okNo install spec is provided (instruction-only) and the single script is readable; nothing is downloaded or extracted from external URLs. This is low-risk from an installation perspective.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. The script reads only its CLI arguments and uses awk; no sensitive environment access is attempted.
- Persistence & Privilege
- okThe skill does not request permanent presence (always:false) and does not modify system or other skill configurations. It does not require elevated privileges.