Back to skill
Skillv1.0.0
ClawScan security
Guangzhou City Guide Skill · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 9, 2026, 1:06 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a self-contained, instruction-only Guangzhou city guide that does not request credentials, install software, or instruct the agent to access local files or external endpoints.
- Guidance
- This skill appears coherent and low-risk because it is instruction-only and asks for no credentials or installs. Before enabling it consider: (1) content accuracy and freshness — travel, transport, weather, and policy info can change, so verify time-sensitive facts with official sources; (2) provenance — the source/homepage is unknown, so be cautious about relying on it for legal/visa/health guidance; (3) hallucinations — language-model-generated recommendations may be plausible but incorrect (double-check addresses, opening hours, and prices). If you need real-time data (live weather, train schedules, or bookings), prefer skills/providers that integrate with authoritative APIs and explicitly list required credentials.
Review Dimensions
- Purpose & Capability
- okThe SKILL.md content (attractions, food, culture, transport, tips) matches the skill name and description. The skill does not declare any unrelated environment variables, binaries, or config paths—requirements are proportionate to a travel guide.
- Instruction Scope
- okRuntime instructions are static descriptive content and example prompts. The file does not instruct the agent to read system files, environment variables, or transmit data to external endpoints, nor does it grant broad discretion to gather unrelated context.
- Install Mechanism
- okNo install spec or code files are present (instruction-only), so nothing will be downloaded or written to disk during installation. This is the lowest-risk install model.
- Credentials
- okThe skill declares no required environment variables, credentials, or config paths. There is no apparent need for secrets or system access for the stated purpose.
- Persistence & Privilege
- okThe skill does not request always:true or other elevated persistence. Default autonomous invocation is allowed (platform default) and is not concerning here because the skill has no extra privileges or access.