Skillv1.0.1

ClawScan security

helword · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 10, 2026, 5:44 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is a simple, instruction-only Hello World skill whose requirements and instructions match its stated purpose and do not request extra privileges or secrets.
Guidance: This skill is a minimal, instruction-only greeting template and appears safe: it doesn't require credentials, installs, or external network access. If you install it, expect it to automatically respond when user input matches the listed greeting triggers; if you prefer it not run automatically, disable or remove the skill. As a general precaution, only install skills from sources you trust — instruction-only skills are low-risk, but the broader agent platform still controls what tools the skill can call.

Purpose & Capability: okThe name/description (greeting) matches the SKILL.md triggers and examples. There are no unrelated required env vars, binaries, or config paths — nothing requested that doesn't belong to a greeting/hello-world skill.
Instruction Scope: okThe SKILL.md contains only trigger patterns and says it uses the built-in echo tool to output a greeting. It does not instruct the agent to read files, access credentials, contact external endpoints, or perform other out-of-scope actions.
Install Mechanism: okNo install spec and no code files are present (instruction-only). Nothing will be downloaded or written to disk by the skill itself.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. This is proportional to a simple greeting skill.
Persistence & Privilege: okSkill flags are ordinary (always: false; user-invocable: true). The SKILL.md sets auto_invoke: true for its triggers, which is reasonable for a trigger-driven greeting skill and is not the same as a system-wide 'always' privilege.