Back to skill
Skillv1.0.0
ClawScan security
ASCII Excalidraw · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 30, 2026, 3:42 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and instructions are consistent with converting ASCII diagrams to Excalidraw JSON and do not request unrelated credentials, installs, or system privileges.
- Guidance
- This skill appears coherent and low-risk: it converts ASCII art to Excalidraw JSON and includes a safe local merge script. Before installing, you may (1) quickly skim SKILL.md for any unexpected network calls or instructions to upload files, (2) run the provided Python script locally on example JSON to verify behavior, and (3) avoid pasting sensitive secrets or private diagrams if you plan to publish or share generated Excalidraw links (opening or sharing via excalidraw.com could send data to that site).
Review Dimensions
- Purpose & Capability
- okThe name/description (ASCII → Excalidraw) matches the included assets: a detailed SKILL.md describing parsing/generation and a small helper script (scripts/merge_modules.py) that merges module JSON into a .excalidraw file. No extraneous binaries, services, or credentials are required.
- Instruction Scope
- okThe runtime instructions (SKILL.md) focus on analyzing ASCII diagrams, generating module-by-module Excalidraw JSON, and merging them. The helper script only reads provided JSON module files, updates element IDs/bindings, and writes an output file; it does not access network endpoints, other unrelated files, or environment variables.
- Install Mechanism
- okThere is no install spec (instruction-only plus a small local script). Nothing is downloaded or installed, and no archives or third-party packages are pulled in by the skill itself.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The code and instructions do not reference secrets or external service tokens.
- Persistence & Privilege
- okalways is false and the skill does not request persistent/privileged presence or attempt to modify other skills or system-wide agent settings. Autonomous invocation is allowed by default, which is normal and expected.