Back to skill
Skillv2.0.0
ClawScan security
Insurance Advisor · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 17, 2026, 6:52 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's files and instructions are consistent with an insurance/advice CLI that persists local user data; nothing in the provided artifacts indicates covert exfiltration or unrelated privileges, but parts of the scripts were truncated in the listing so review the full files before trusting them.
- Guidance
- This skill appears to do what it claims: insurance advice and simple local data management. Before installing: 1) Review the full contents of scripts/insurance.sh and scripts/script.sh (the provided listing was truncated) to confirm there are no hidden network calls or other unexpected behavior. 2) Be aware the tool creates and writes logs and export files under ~/.local/share/insurance-advisor — those files may contain personal or medical information, so treat them as sensitive. 3) If you want to limit risk, run the skill in a sandboxed environment or inspect/execute the scripts manually rather than letting an autonomous agent run them. 4) If you keep it, periodically inspect or remove the data directory if you no longer want stored history.
Review Dimensions
- Purpose & Capability
- okThe name/description (insurance advice, product comparison, premium calc, claim guidance) match the provided bash scripts and SKILL.md. The scripts implement recommendation, comparison, premium estimation and also provide local personal-finance-style commands (record, export, search) which are within the broader scope of a personal insurance advisor tool.
- Instruction Scope
- noteSKILL.md is instruction-only help text and matches the CLI behavior. The included scripts accept user inputs and log them locally; they do not (in the visible portions) read unrelated system paths or request external credentials. However, the scripts will persist user-provided content (potentially sensitive personal/medical info) to ~/.local/share/insurance-advisor, so the agent using the skill may store PII locally unless the user is careful. Also: the provided file listings are truncated in places — the truncated parts should be reviewed for any additional behavior.
- Install Mechanism
- okNo install spec (instruction-only skill) and code files are bundled directly. No downloads, package installs, or external installers were present in the provided metadata.
- Credentials
- noteThe skill requests no environment variables or external credentials. It does use $HOME to create and write a data directory (~/.local/share/insurance-advisor) to store logs/exports; this is proportionate to a tool that records user entries but is important from a privacy perspective because those logs may include sensitive information.
- Persistence & Privilege
- notealways:false (no forced inclusion). The scripts create and write files under the user's home directory (data dir and multiple .log files) and produce exports (json/csv/txt). This is expected for a local advisor but means the skill persists user data; there is no indication it alters other skills or system-wide settings.