Skillv1.0.0

ClawScan security

Trip Planner Generator · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignApr 5, 2026, 3:55 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only travel itinerary generator whose requested actions and data collection are consistent with its stated purpose.
Guidance: This skill appears internally consistent and appropriate for creating trip itineraries. Before installing or using it, be aware it will ask for personal trip details (dates, passenger composition, transport, and may ask about identity documents). Only provide what is necessary—avoid sharing full ID numbers, passport numbers, payment credentials, or other sensitive identifiers. If you plan to export plans to another skill (trip-website-generator), verify that other skill's trustworthiness and data handling. Monitor what the agent asks; if it starts requesting unrelated system info or credentials, stop and review. If you need stronger privacy, instruct the agent not to store or transmit sensitive fields, or provide redacted placeholders instead of real IDs.

Review Dimensions

Purpose & Capability: okName and description match the SKILL.md: it guides an interactive Q&A to produce structured travel itineraries and a parseable output for a website. Asking travel-related questions and producing the shown markdown format is coherent with a 'Trip Planner Generator'. The only external dependency is the AskUserQuestion tool referenced in the instructions, which is reasonable for interactive collection.
Instruction Scope: noteInstructions stay within travel-planning scope and do not instruct reading system files, environment variables, or making arbitrary network calls. They do instruct collecting user-provided personal trip details (dates, passenger composition, transport, and example items like IDs), which is expected for the task but may involve personally identifiable information (PII).
Install Mechanism: okNo install spec and no code files (instruction-only). Nothing is written to disk or fetched at install time—this is low-risk and appropriate for the described functionality.
Credentials: okThe skill declares no required environment variables, credentials, or config paths. That is proportionate for an instruction-only itinerary generator. Note: while it doesn't request credentials, it does prompt users for trip-related personal data (IDs, passenger details), which is reasonable but sensitive.
Persistence & Privilege: okalways is false and the skill does not request persistent system privileges or modifications to other skills or system settings. Autonomous invocation is allowed (platform default) but not combined with other red flags.