Skillv3.0.0

ClawScan security

First Aid · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 19, 2026, 12:10 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code and instructions match its stated purpose (a local first-aid reference); it runs a small local shell script, requests no credentials, and does not perform network activity.
Guidance: This skill appears to be a simple, local first-aid reference implemented as a small shell script. If you plan to install/use it: (1) confirm you are comfortable with it creating ~/.local/share/first-aid (it stores any data there); (2) review scripts/script.sh yourself (it's short and contains only printed text and a mkdir); (3) if you want stronger assurance, verify the author/homepage (bytesagain.com) or run the script in a restricted environment. There is no evidence of network activity or credential access in the provided files.

Purpose & Capability: okName/description (first aid reference) align with what is provided: a local script offering guides, emergency numbers, kit checklists and a quiz. No unrelated capabilities or credentials are requested.
Instruction Scope: noteSKILL.md directs the agent to run the included scripts/script.sh commands. The script only prints canned guidance and creates a data directory at ~/.local/share/first-aid; it does not read other files, access network endpoints, or exfiltrate data. Note: it creates/uses a directory in the user's home for storage.
Install Mechanism: okNo install spec — instruction-only with a bundled script. Nothing is downloaded or extracted from external URLs.
Credentials: okNo environment variables, credentials, or config paths are required beyond using $HOME for the data directory, which is appropriate for local data storage.
Persistence & Privilege: okalways:false and default invocation settings. The skill only creates its own data directory and does not modify other skills or system-wide settings.