Back to skill
Skillv1.0.0
ClawScan security
🇺🇸 美国最新关税政策查询 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 6:40 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- An instruction-only skill that queries public U.S. trade sources for tariff information; its requirements and behavior are broadly consistent with that purpose, but a few vague calibration/compatibility notes merit confirmation before install.
- Guidance
- This skill appears coherent and low-risk: it is instruction-only, asks for no secrets, and cites official sources. Before installing, confirm two small items with the author or platform: (1) what do the "compatibility" and "API channel availability" calibration checks actually do — do they only call public endpoints or do they interact with other installed skills/configs? (2) what does "trustedMode": true mean in practice (any elevated privileges or background polling)? Also review the platform tools (tavily-web, web_fetch) permissions on your agent — ensure they cannot access private files or other credentials. If you want extra caution, disable autonomous invocation or monitor network activity the first time you run the skill.
Review Dimensions
- Purpose & Capability
- okName/description match the declared behavior: the skill queries US tariff/policy data and lists appropriate public sources (USITC, CBP, USTR, Federal Register). The SKILL.md requests web-fetching tools (tavily-web, web_fetch) which are coherent with making public web/API requests. There are no unrelated env vars, binaries, or config paths required.
- Instruction Scope
- noteRuntime instructions stick to querying public sources and formatting results. However, the calibration steps mention: "API查询通道可用性检测" and "与其他已安装政策查询Skill的兼容性" — this could trigger extra network probes or interactions with other installed skills. The SKILL.md does not explicitly instruct reading local files, credentials, or sending data to non-official endpoints, but the calibration wording is somewhat vague and should be clarified (what exactly does compatibility testing do?).
- Install Mechanism
- okNo install spec and no code files — this is instruction-only, so nothing is downloaded or written by the skill itself. Low surface area for supply-chain risk from the skill bundle.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. The only external dependencies are platform-provided web-fetch tools referenced in metadata, which are proportionate to the stated task of querying public government sites.
- Persistence & Privilege
- noteThe skill is not marked always:true and is user-invocable (normal). _meta.json includes calibration fields (interval and "trustedMode": true) which suggest periodic checks or a privileged calibration mode; since those are not further described, verify what "trustedMode" entails and whether periodic background activity or automatic network checks will run.