Skillscanner

**Judgement:** Skillscanner is a focused, high‑value safety helper for ClawHub that should be treated as a strong first line of defense, not a sole arbitrator of trust. **What it does:** It takes a ClawHub skill URL, calls Gen Digital’s scan API, and returns a verdict based on: - `status = done` → check `severity`; only `SAFE` should be treated as cleared. - `status = analysis_pending` → treat as unknown/pending; do **not** assume safety. **Key risks and limitations:** - **Detection is only as strong as the Gen Digital backend.** Obfuscated or novel threats may evade detection (false negatives). - **No positive guarantee of safety.** Even `SAFE` means “no issues currently known,” not “provably harmless.” - **External dependency and availability risk.** If the scan API is slow or down, automation relying on this skill may fail or stall. - **Privacy / exposure considerations.** Skill URLs you scan are sent to an external service (Gen Digital), which may matter in sensitive environments. **Recommended scenarios:** - Use as a **mandatory gate** before agents install or execute third‑party ClawHub skills, especially where skills can run code or access data. - Integrate into **security review workflows** for new or updated skills used across a team or organization. - Combine with **sandboxing, least privilege, and manual review** for high‑impact or high‑risk skills, treating non‑SAFE severities and `analysis_pending` as hard stops until cleared.