Skillv0.0.1

ClawScan security

Anime Garden · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 7, 2026, 11:36 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's declared purpose (searching an anime torrent aggregation API) matches its instructions and requirements; it makes no surprising requests for credentials, installs, or local access.
Guidance: This skill is coherent with its stated purpose and appears to only perform HTTP queries against https://api.animes.garden. Before installing: verify you trust the API host (it will return magnet links/trackers and other torrent metadata), be aware of legal/copyright implications in your jurisdiction for accessing or using torrent resources, and confirm you are comfortable with the agent making outbound network requests to that domain. If you need the agent to act autonomously with this skill, check the platform's agent autonomy settings; autonomous invocation is allowed by default but is not required to use the skill interactively.

Purpose & Capability: okName/description promise (search anime resources via Anime Garden) aligns with the provided SKILL.md and references/api.md: all instructions are about building filters, calling https://api.animes.garden endpoints, and normalizing responses. The skill does not ask for unrelated credentials, binaries, or config paths.
Instruction Scope: okSKILL.md and references/api.md instruct only network calls to the documented API endpoints (GET/POST /resources, GET /detail/{provider}/{id}, metadata endpoints). There are no instructions to read local files, environment variables, or transmit data to unexpected endpoints.
Install Mechanism: okInstruction-only skill with no install spec and no code files to write or execute. This is the lowest-risk install model and matches the skill's purpose.
Credentials: okNo environment variables, credentials, or config paths are requested. The level of access requested (none) is proportionate to a read-only API integration.
Persistence & Privilege: okalways is false and disable-model-invocation is false (normal). The skill does not request persistent system presence or modification of other skills/config; this is proportionate for an API-search skill.