Back to skill
Skillv1.0.1
ClawScan security
ClawCoach Food · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 23, 2026, 3:29 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally coherent for a photo-based meal-logging tool (it reasonably needs an Anthropic API key and stores logs locally), but it reads/writes local files and sends images to an external model provider — the skill should explicitly declare those file paths and data flows so you can make an informed choice.
- Guidance
- This skill appears to do what it says: it uses Claude Vision (Anthropic) to analyze meal photos, confirms with the user, and stores confirmed meals in ~/.clawcoach/food-log.json while reading targets from ~/.clawcoach/profile.json. Before installing: 1) Confirm you are comfortable with images being sent to Anthropic (the ANTHROPIC_API_KEY implies outbound image/text data will go to that provider). 2) Be aware that the skill will create and modify files in your home directory (~/.clawcoach/food-log.json and profile.json); review these files after first use and back them up if they will contain sensitive info. 3) Ask the maintainer (or check the repo) to update registry metadata to explicitly list the config paths and to document any additional data sharing, retention, or deletion policies. 4) If you do not want autonomous invocation, disable model invocation for this skill or only enable it when needed. If you need greater assurance, request the source code or a privacy/security statement from the publisher before using.
Review Dimensions
- Purpose & Capability
- noteName and description match the declared requirement (ANTHROPIC_API_KEY) for using Claude Vision; asking for an Anthropic key is appropriate. However, the skill operates on local files (~/.clawcoach/food-log.json and ~/.clawcoach/profile.json) but the registry metadata did not declare any required config paths — the use of those local paths should have been declared.
- Instruction Scope
- noteSKILL.md explicitly instructs the agent to analyze images (using vision capabilities), to write confirmed meals to ~/.clawcoach/food-log.json, and to read targets from ~/.clawcoach/profile.json. Those actions are within the stated purpose (meal logging) but they involve reading and writing files in the user's home directory and sending image data to an external model provider; the file I/O and external transmission are material privacy/security behaviors and should be explicitly documented in metadata.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — lowest-risk install footprint. Nothing will be written to disk by an installer beyond the agent using the instructions at runtime.
- Credentials
- okOnly ANTHROPIC_API_KEY is required (appropriate for Claude Vision usage). No unrelated credentials or broad environment access are requested.
- Persistence & Privilege
- notealways:false (normal). The skill will create/read files under ~/.clawcoach which is expected for a local meal logger; it does not request system-wide changes or other skills' credentials. Note that the skill is allowed to be invoked autonomously by the agent by default (disable-model-invocation:false) — this is platform-normal but increases the importance of understanding data flows.