Skillv1.0.0

ClawScan security

Arrivelah · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 26, 2026, 2:30 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code, instructions, and requirements match its description: a small script that reads a local config and queries the Arrivelah2 bus arrival API; nothing appears disproportionate or hidden.
Guidance: This skill is small and coherent: it reads the provided config.json and issues an HTTPS request to the Arrivelah2 API. Before installing, verify you are comfortable with outbound HTTP requests to the apiUrl in config.json (default: https://arrivelah2.busrouter.sg). Ensure curl and jq are available. If you change apiUrl, only point it to trusted endpoints since the script will send your configured stop ID there. No credentials are requested and no other files or system credentials are accessed.

Purpose & Capability: okName/description (one-word trigger for next bus arrival) align with the shipped files: a short bash script and a config.json containing stop/service and apiUrl. Required binaries (curl, jq) are appropriate and expected.
Instruction Scope: okSKILL.md confines behavior to reading config.json and calling the Arrivelah2 API. The runtime script only reads its own config file and prints parsed results; it does not reference other system files, credentials, or unexpected endpoints.
Install Mechanism: okThere is no install spec (instruction-only plus included script), so nothing arbitrary is downloaded or installed. Risk is low because the script is small, readable, and included in the package.
Credentials: okThe skill requests no environment variables or credentials. It only reads a local config.json. There are no unexplained secrets or cross-service tokens.
Persistence & Privilege: okThe skill is not always-enabled and does not modify other skills or system settings. It has no persistent background components or privilege-escalating behaviors.