Back to skill
Skillv1.3.0
ClawScan security
Driver Receipt Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 16, 2026, 7:42 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This instruction-only skill is internally consistent: it uses the ReceAI web service to generate driver receipts and requests no local credentials or installs, but it will transmit ride and passenger data to a third‑party site (receai.com).
- Guidance
- This skill appears coherent and low-risk for your system, but it will send ride details and passenger contact information to a third party (receai.com). Before installing or using it: 1) Review ReceAI's privacy and data‑retention policies and confirm how they store or share receipts and emails. 2) Avoid including sensitive data (full payment card numbers, SSNs) in receipts sent through the skill. 3) If email sending is enabled, be aware passenger addresses will be passed to the external service. 4) Test with dummy data to verify behavior (formatting, whether receipts are stored, whether emails are actually sent). 5) If you need stricter control over data (on‑device generation, no third‑party storage), consider a local/offline receipt tool instead. If you want, I can help draft a minimal test prompt to validate how the skill interacts with ReceAI without exposing real PII.
Review Dimensions
- Purpose & Capability
- okThe skill's name, description, and instructions all describe generating receipts via ReceAI; there are no unrelated environment variables, binaries, or install steps requested. The requested capabilities align with the stated purpose.
- Instruction Scope
- noteSKILL.md instructs the agent to generate receipts via ReceAI and to email/share links; it does not ask the agent to read local files or secrets. However, using the skill will result in sending ride details and passenger emails (PII) to an external service (receai.com). The instructions do not detail API/auth requirements or how data is transmitted, so users should assume unencrypted web requests or third‑party storage unless verified otherwise.
- Install Mechanism
- okNo install spec or code is provided (instruction-only), so nothing is written to disk or downloaded during install. This is the lowest-risk install profile.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths. That is proportionate to an instruction-only wrapper around a third‑party web service which claims basic use without an account.
- Persistence & Privilege
- okThe skill is not always-enabled and does not request elevated privileges or to modify other skills. Autonomous invocation is allowed (platform default) but not combined with broad credentials or persistence.