Skillv2.0.0

ClawScan security

OpenClaw Color Palette · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 7, 2026, 2:10 AM

Verdict: benign
Confidence: medium
Model: gpt-5-mini
Summary: The skill's requests and instructions are coherent with a color/palette service, but it relies on an external MCP endpoint (Cloudflare Workers URL) so users should verify the service and avoid sending sensitive images without confirming data handling.
Guidance: This skill appears to do what it says (color math, WCAG checks, conversions, and image color extraction). Before installing or using it, verify the external endpoint and owner: confirm the GitHub repository and the MCP URL (color-palette-mcp.yagami8095.workers.dev) are trustworthy. Do not upload sensitive or proprietary images (e.g., private user photos or unreleased brand assets) until you know how the service stores or logs data and how long it is retained. If you require on-device processing for privacy, prefer a local tool or ask the developer for an offline implementation. Finally, ask the publisher for a privacy/data-retention policy and whether any user data is persisted or shared with third parties.

Purpose & Capability: okName, description, and declared capabilities (palette generation, WCAG checks, conversions, color-blindness simulation, image color extraction) align with the skill's instructions. The skill does not request unrelated credentials, binaries, or system paths. Minor metadata mismatch: registry lists no homepage but SKILL.md includes a GitHub URL.
Instruction Scope: concernThe SKILL.md points to an external MCP endpoint (https://color-palette-mcp.yagami8095.workers.dev/mcp) and advertises streaming/http usage; that implies user-provided images or color data may be sent to that remote service for processing. The instructions otherwise do not instruct reading unrelated system files or credentials. Users should be aware of potential privacy/data-exfiltration risk for uploaded images or logos.
Install Mechanism: okNo install spec and no code files — instruction-only — so nothing is written to disk or installed locally. This is low-risk from an installation/execution perspective.
Credentials: okThe skill requests no environment variables, credentials, or config paths. This is proportionate to its described functionality and reduces credential-exfiltration risk.
Persistence & Privilege: okalways is false and there are no config writes or requests for system-level changes. The skill is user-invocable and allows model invocation (platform default), which is expected and appropriate here.