Back to skill
Skillv0.1.0
ClawScan security
Personal Growth Coach · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 13, 2026, 5:53 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This instruction-only skill is internally consistent with its stated purpose (daily thinking exercises) but it reads and writes local 'memory' records, so users should be aware of where that data is stored and what personal information may be recorded.
- Guidance
- This skill is coherent and appears to do what it says: generate daily thinking exercises and track progress. Before installing, consider: (1) it will read and write files under memory/personal-growth-records/ — check where your agent stores that memory and whether you are comfortable with potentially sensitive notes being persisted; (2) there are no external network calls or credential requests declared, but confirm your agent's runtime won't automatically sync those memory files to external services you didn't expect; (3) if you prefer not to have stored records, ask the agent to run the exercises without saving progress or to store them in a location you control. If you want greater assurance, request the author to declare the memory/config path in the skill metadata so the file access is explicit.
Review Dimensions
- Purpose & Capability
- okName and description (daily thinking practice) match the instructions (generate open-ended exercises, apply Pyramid Principle and other frameworks). The skill personalizes exercises by reading/writing learning records in a 'memory' directory, which is coherent for a progress-tracking coach.
- Instruction Scope
- noteSKILL.md explicitly instructs the agent to read 'memory/personal-growth-records.md' and to update files under 'memory/personal-growth-records/'. That file I/O is within the skill's purpose (personalized quizzes), but the skill did not declare these config paths in the metadata. Users should note the skill will access and persist session data in the agent's memory store.
- Install Mechanism
- okNo install spec and no code files — instruction-only. No downloads or package installs are requested, which is the lowest-risk install footprint.
- Credentials
- okThe skill requires no environment variables, credentials, or external services. No requests for unrelated secrets are present.
- Persistence & Privilege
- notealways:false (normal). The skill will persist session records into a local memory directory per its instructions; it does not request system-wide or cross-skill configuration changes. The default ability for the agent to invoke the skill autonomously is allowed by platform defaults, which is expected for this kind of assistant skill.