Back to skill
Skillv1.0.0
ClawScan security
Claw History · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 16, 2026, 9:26 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and runtime instructions match its stated purpose — it reconstructs an agent timeline by reading local memory and log files — it asks for broad local read access but requires no installs, credentials, or external endpoints.
- Guidance
- This skill will try to read your agent's local memory files and logs to reconstruct a complete timeline. That behavior is expected for a history tool, but you should: (1) confirm you are comfortable with the agent reading workspace/memory/*.md, MEMORY.md, session inventories, and any command logs; (2) only enable the recommended hooks (session-memory, command-logger) if you want persistent, auditable logging — enabling them increases retained telemetry; (3) consider running in an isolated workspace if logs contain sensitive data; and (4) verify there are no unexpected network endpoints or credential requests (none are declared). If you want tighter limits, ask the agent to restrict sources (e.g., only current session) before running the skill.
Review Dimensions
- Purpose & Capability
- okThe name/description (produce a lifetime action timeline) aligns with the resources the skill asks to read: memory/YYYY-MM-DD*.md, MEMORY.md, session inventories, and conversation/tool logs. These data sources are reasonable for producing a full-history report.
- Instruction Scope
- noteSKILL.md explicitly directs the agent to scan multiple local data sources (workspace memory files, session inventories, sub-agent sessions when accessible, and tool logs). That is coherent with the stated goal but means the skill will attempt to read potentially sensitive local files and cross-session data. It correctly requires the skill to report gaps when sources are unavailable.
- Install Mechanism
- okInstruction-only skill with no install spec or external downloads; lowest install risk. No code files are included, so nothing is written to disk by an installer.
- Credentials
- okNo environment variables, credentials, or external endpoints are requested. The only access needed is read access to local memory/log files, which is proportional to building a lifetime timeline.
- Persistence & Privilege
- okalways:false and no indications the skill modifies other skills or system-wide settings. The README recommends enabling optional hooks (session-memory, command-logger) for better coverage — enabling those is an explicit user action and not required by the skill itself.