Back to skill
Skillv1.0.0
ClawScan security
Calendar · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 10, 2026, 3:59 PM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's requested capabilities and instructions match a simple calendar manager; it is instruction-only and stores data under /workspace/data/calendar/, which is the main thing to be aware of.
- Guidance
- This appears to be a simple, coherent calendar skill that stores events under /workspace/data/calendar/. Before installing, confirm you are comfortable with calendar data being persisted in the agent's workspace (check retention/backup/privacy policies). Because the skill is instruction-only and has no code to inspect, you cannot audit implementation details — if you need stronger guarantees (encryption, remote sync, or no persistent storage), ask the publisher for details or avoid storing sensitive events here.
Review Dimensions
- Purpose & Capability
- noteName/description (calendar: create events, reminders, view schedule) align with the SKILL.md functionality. The skill does declare a storage location (/workspace/data/calendar/), which is reasonable for a calendar but is not listed in the registry 'required config paths' — users should note the skill will persist data to that path.
- Instruction Scope
- okSKILL.md contains only calendar-related instructions and examples. It does not instruct reading unrelated files or env vars, nor sending data to external endpoints. The only notable instruction is the explicit storage location for calendar data.
- Install Mechanism
- okNo install spec and no code files are present (instruction-only). This is the lowest-risk install model — nothing will be written to disk by an installer beyond what the agent itself does at runtime.
- Credentials
- noteThe skill requests no environment variables or credentials, which is appropriate. However it will persist data to /workspace/data/calendar/ (implying the agent needs write access to that workspace), so users should be comfortable with calendar data being stored there.
- Persistence & Privilege
- okalways is false and the skill is user-invocable (normal). The skill declares a persistent storage path for its own data but does not request elevated or cross-skill privileges.