Back to skill
Skillv1.0.0
ClawScan security
Baby record · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 3:52 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and resource requests are consistent with a local baby-care JSON logger that reads/writes files and processes images; no network, credentials, or unusual privileges are requested.
- Guidance
- This skill appears coherent and local-only: it parses user text/images, asks you to confirm extracted data, and saves records as JSON files in a data directory. Before installing, consider: 1) The agent will need a Python interpreter available to run the script (the metadata did not list 'python' as a required binary). 2) Records (photos or health details) are stored as plain JSON files in the skill's data directory (or any path you pass via --dir); if these are sensitive, store them on encrypted storage or restrict the directory. 3) The image-to-data step relies on the agent's vision/OCR — ensure you are comfortable with the agent processing any photos you upload. If you need networked backups, sharing, or encrypted storage, that would require additional code or configuration not included here.
Review Dimensions
- Purpose & Capability
- noteName/description, SKILL.md, and the included Python script all align: this is a local daily baby-record tool that saves JSON files and summarizes trends. One minor inconsistency: the runtime instructions call the system 'python' executable, but the skill metadata did not declare any required binaries. In practice the agent environment must provide a Python interpreter for the script to run.
- Instruction Scope
- okSKILL.md confines behavior to parsing user text/images, confirming with the user, and calling the included script to save/query local JSON files. It explicitly requires user confirmation before saving OCR/extracted image data. No instructions request reading unrelated files, environment variables, or sending data to external endpoints.
- Install Mechanism
- okNo install spec or external downloads; the bundle is instruction-plus-local Python script. Nothing is fetched from external URLs and no archives are extracted.
- Credentials
- okThe skill requests no environment variables or credentials. Its file I/O is limited to a data directory (by default under the skill bundle) and an optional user-specified --dir. This is proportional to its purpose. Note: running the script requires filesystem write access and a local Python runtime.
- Persistence & Privilege
- okalways:false and no special privileges are requested. The skill does not modify other skills or system-wide configurations; its persistence is limited to creating/reading JSON files under its data directory or a user-provided directory.