Back to skill
Skillv2.0.1
ClawScan security
Contact Book · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 18, 2026, 10:39 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code and runtime instructions match its stated purpose: a simple local CLI contact tracker that stores plain-text logs under ~/.local/share/contact-book and performs no network activity.
- Guidance
- This is a small, local CLI tool that stores contact notes in plain-text files under ~/.local/share/contact-book. It appears coherent and contains no network calls or secret requests. Before installing or running it: (1) review or run the script to confirm behavior; (2) be aware that contact data is stored unencrypted in plain text — protect the directory (filesystem permissions, backups); (3) exported JSON/CSV may be malformed if entries contain quotes or newlines; (4) the tool will create/modify files in your home directory, so if you need isolation run it in a controlled environment or container.
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md, and the included Bash script all align: commands create and read per-command log files in a local data directory. No extraneous credentials, binaries, or unrelated functionality are requested.
- Instruction Scope
- noteInstructions and script are scoped to local file operations and CLI behavior. The script writes/reads log files under $HOME/.local/share/contact-book and uses common shell utilities (grep, tail, wc, du, head). No network endpoints or external services are referenced. Minor implementation issues: history.log entries use a different format than the per-command logs (may make some 'since' or 'last activity' outputs show 'N/A' or malformed), and exports are not escaping quotes/newlines which can break JSON/CSV formatting — functional issues but not malicious.
- Install Mechanism
- okNo install spec and only a small shell script are included. There's no package download or archive extraction. Risk from installation is minimal; the script will be executed on demand and creates a directory under the user's home directory.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths beyond writing to the user's home directory. This is proportional to a local contact-tracking tool. The script does rely on standard shell utilities being present.
- Persistence & Privilege
- okThe skill does not request 'always' presence and does not modify other skills or global agent config. It persists data only in its own data directory under the user's home.