Back to skill
Skillv1.0.0
ClawScan security
Travel Biz · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 29, 2026, 6:48 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's declared purpose (travel + expense + receipt + invoice) matches its contents: an instruction-only fusion helper with no installs or requested credentials and a tiny benign test script.
- Guidance
- This skill is an instruction-only travel/expense assistant and appears coherent and low-risk. Things to consider before installing: (1) The SKILL.md describes booking, calendar sync, OCR, and exporting but contains no implementation—those actions will require other skills or user-provided credentials/services (e.g., calendar API, booking accounts, OCR provider). Only grant those credentials when you trust the target service. (2) The skill stores data under ~/travel-biz — review and control that directory if you care about local data residency. (3) The included scripts/test.sh is harmless and just checks SKILL.md size; no downloads or remote endpoints are present. If you plan to use automatic receipt uploads or cloud OCR, verify where images and extracted data are sent and who has access. Overall the package is internally consistent, but pay attention to any downstream services you connect it to.
Review Dimensions
- Purpose & Capability
- okName/description describe an integrated travel & expense assistant; SKILL.md content and metadata declare fusion of travel, expense, receipt, and invoice skills. The skill does not request unrelated credentials or binaries, so the declared capabilities are proportionate to what the skill asks for.
- Instruction Scope
- noteRuntime instructions are high-level and describe features (booking, OCR, calendar sync, export) but provide no implementation or external endpoints — this is normal for an instruction-only fusion skill that depends on other skills or user-supplied services. The SKILL.md does specify a local storage path under ~/travel-biz for records, which is reasonable. Because the instructions are vague about which external services or credentials to use, the agent will need to request or be granted those separately at runtime.
- Install Mechanism
- okNo install spec provided. The skill is instruction-only plus a small test script; nothing is downloaded or written during installation. This is low-risk.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. That is consistent with being an instruction-only wrapper that relies on other skills or interactive user-supplied credentials for booking, calendar access, or OCR.
- Persistence & Privilege
- okalways is false and the skill does not request persistent elevated privileges or modify other skills' configurations. It will create/expect data under the user's home (~/travel-biz), which is appropriate for a personal assistant.