Back to skill
Skillv1.2.0
ClawScan security
awesome-design-skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 23, 2026, 9:58 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, scripts, and runtime instructions are coherent with its stated purpose (selecting and applying design-system guidelines); no unexplained credentials, installs, or high‑privilege behaviors were found.
- Guidance
- This skill appears to do what it says: it ships a large offline library of DESIGN.md files and small shell scripts to list/select/copy them, and its instructions tell the agent to read project files and copy DESIGN.md into the working directory when you ask it to apply a style. Before installing, consider: (1) the agent will read and write files in the current project when asked to 'restructure' a page—only invoke it on projects you trust or in a sandbox; (2) preview HTML files reference external hosts (fonts.loli.net and hosted preview images) which may be fetched if previews are rendered — review those URLs if you have network/privacy concerns; (3) the included scripts (scripts/*.sh) are executed by the agent per the SKILL.md workflow — if you or your org requires code review, open and inspect smart-select.sh and the other scripts before running them. Otherwise, the manifest and instructions are coherent with the stated design-style purpose.
Review Dimensions
- Purpose & Capability
- okName/description (design-style selector) match the included assets: a large design-md library (DESIGN.md + previews) and helper scripts for listing, selecting, copying, and reading styles. The requested capabilities (reading/writing DESIGN.md, choosing a style) align with what the skill actually provides.
- Instruction Scope
- noteSKILL.md tells the agent to run the included scripts and to read and (when requested) modify files in the current project (e.g., read the user's HTML page to 'restructure' it and copy DESIGN.md into the working directory). This file I/O is proportionate to a style-application skill, but users should be aware the agent will read and write local project files when invoked for page refactors.
- Install Mechanism
- okNo install spec (instruction-only) and no dependencies requested, which is the lowest-risk model. The repository contains static assets and shell scripts only. The preview HTML files reference external font/image hosts (fonts.loli.net and some r2.dev image URLs) — those are passive web resources but will cause outbound requests if previews are rendered or fetched.
- Credentials
- okNo environment variables, credentials, or config paths are requested. The skill does not ask for secrets or unrelated service keys; that is proportionate to its purpose.
- Persistence & Privilege
- okalways:false and no requests to modify other skills or global agent configuration. The skill will be invoked only when triggered and can run included scripts; autonomous invocation is allowed by default (platform behavior) but isn’t unusually privileged here.