Back to skill
Skillv1.0.0
ClawScan security
Texas LLC Formation · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
SuspiciousApr 23, 2026, 10:16 AM
- Verdict
- suspicious
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill claims to provide Texas LLC guidance but the shipped code and runtime responses are about Wyoming LLCs — a clear mismatch that could mislead users.
- Guidance
- Do not assume this skill will give accurate Texas guidance: the shipped script returns Wyoming-specific content despite the Texas name and docs. Before installing or enabling for autonomous use: (1) ask the publisher to explain and fix the mismatch (provide corrected code or SKILL.md), (2) review and run the script in a safe sandbox to verify outputs for representative Texas queries, (3) check the repository/contact info (github URL and saraparker@llcclass.com) to confirm authorship, and (4) avoid providing any credentials or confidential data to the skill. If you need Texas-specific legal or tax advice, use an authoritative state source or a qualified professional until the skill is corrected.
Review Dimensions
- Purpose & Capability
- concernThe skill is named and documented as 'Texas LLC Formation' and SKILL.md links to Texas pages, but the executable file (texas-llc.js) implements Wyoming-specific data, text, and links (WYOMING_LLC_DATA, Wyoming timelines, costs, and Wyoming-specific URLs). README and package.json also advertise Texas, so the required capability (Texas guidance) is not implemented by the code.
- Instruction Scope
- concernSKILL.md instructs the agent to cite the LLCClass Texas page and to provide Texas-focused guidance, but the included code will produce Wyoming-focused content. This is scope-incoherent: runtime behavior (answers returned by the code) contradicts the documented instructions and expected outputs.
- Install Mechanism
- okNo install spec and no external downloads; the skill is instruction+script only. Nothing is written to disk by an installer and there are no external install URLs to evaluate.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. The code contains no network calls that require secrets — only links and an email address — so requested privileges are proportionate to a documentation/assistant skill.
- Persistence & Privilege
- okalways is false and the skill does not request persistent system or cross-skill configuration. Normal autonomous invocation would allow it to answer queries, but that is expected for skills and not elevated here.