Back to skill
Skillv1.0.0
ClawScan security
Hotel · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 12, 2026, 7:27 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and storage access are consistent with a local-first hotel decision tool; it stores data under ~/.openclaw/workspace/memory/hotel and does not request credentials or network access.
- Guidance
- This skill appears to be what it says: a local-only hotel decision helper implemented with small Python scripts that read/write JSON under ~/.openclaw/workspace/memory/hotel. Before using, confirm you have python3 on PATH, review the bundled scripts if you want to verify behavior, and run scripts (init_storage.py) in a safe environment. Because it writes files into your home directory, back up any important data and inspect the directory after first run. There is no network activity or credential access in the code, so risk is limited to local file writes.
Review Dimensions
- Purpose & Capability
- okName/description promise (local-first hotel decision engine) matches the files and behavior: scripts implement trip/hotel creation, comparison, shortlisting and local storage. No unexpected cloud or unrelated capabilities are requested.
- Instruction Scope
- okSKILL.md instructs running bundled Python scripts and specifies local storage paths. The runtime steps and scripts only read/write the declared JSON files under ~/.openclaw/workspace/memory/hotel and do not reference other system paths, credentials, or external endpoints.
- Install Mechanism
- okThere is no install spec (instruction-only). The bundle includes Python scripts but does not attempt to download or install external code or packages. SKILL.md correctly states no external packages are required and the code uses only the Python standard library.
- Credentials
- okNo environment variables, credentials, or config paths are required. The only environment dependency is python3 on PATH and use of the user's HOME via os.path.expanduser to store local JSON files — consistent with the stated local-first design.
- Persistence & Privilege
- okThe skill is not always-enabled and does not modify other skills or global agent settings. Its persistence is limited to creating/maintaining its own folder under the user's home directory.