Skillv1.0.0

ClawScan security

chinese-huangdi-health-timer · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 3, 2026, 8:46 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only Chinese medicine timer/tip generator that only bundles local JSON tips and a short SKILL.md; its requirements and instructions are coherent with its stated purpose.
Guidance: This skill appears coherent and low-risk from a security perspective because it only serves local tip data and simple instructions. Before installing, be aware: (1) the content is health advice based on traditional medicine—do not substitute it for professional medical diagnosis; (2) although the skill itself does not collect or transmit data, avoid supplying sensitive personal health information when invoking it unless you trust where your agent sends user content; and (3) if you need regulatory-safe medical guidance, use a qualified health provider or a medically focused service instead.

Purpose & Capability: okName and description match the included files (SKILL.md and health-tips.json). There are no unexpected required binaries, credentials, or config paths that would be unrelated to producing time-based health tips.
Instruction Scope: okSKILL.md contains only content-generation instructions (12 cycles, 3 unique tips, timezone/language settings). It does not instruct the agent to read arbitrary system files, access environment variables, or send data to external endpoints.
Install Mechanism: okNo install spec and no code files — this is instruction-only. Nothing is downloaded or written to disk by the skill itself.
Credentials: okThe skill requests no environment variables or credentials; the resources it needs (local JSON and SKILL.md) are bundled with the skill.
Persistence & Privilege: okalways is false and the skill does not request persistent/system-wide privileges or attempt to modify other skills or agent configuration.