Back to skill
Skillv1.0.0
ClawScan security
Personal Hygiene · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 18, 2026, 9:17 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's behavior (reading/updating a local knowledge file and tracking grooming routines) matches its description and requests no unrelated credentials or installs, but it will persist personal hygiene data in the agent workspace so consider privacy/retention.
- Guidance
- This skill appears internally consistent and requires nothing beyond local storage of a single knowledge file. Before installing, be aware it will save personal hygiene details (routines, product usage, dates of visits) to knowledge/personal/hygiene.md in the agent workspace. If that concerns you: (1) inspect the file contents and location, (2) configure retention or deletion procedures, (3) avoid putting highly sensitive medical details into the file, and (4) ensure your workspace/backups are protected (access controls/encryption). If you need the assistant not to persist data, do not allow updates to the knowledge file or ask for a version that operates session-only.
Review Dimensions
- Purpose & Capability
- okName/description (personal care assistant: routines, products, reminders) align with the runtime instructions, which only read and update a single workspace file (knowledge/personal/hygiene.md) and use chat history.
- Instruction Scope
- okSKILL.md instructs the agent to read the specified knowledge file before replying, consider chat history, and update that file when the user reports changes. These actions are within the stated purpose. There are no instructions to read unrelated system files, external endpoints, or to exfiltrate data.
- Install Mechanism
- okNo install spec or code files — instruction-only skill. Nothing is downloaded or written to disk by an installer beyond the agent's normal storage of the knowledge file, which is expected for this type of skill.
- Credentials
- noteThe skill requests no environment variables or credentials (proportional). Note: it will store personal care data in the agent workspace file (knowledge/personal/hygiene.md), which may include sensitive personal details — this is logical for the purpose but has privacy implications.
- Persistence & Privilege
- notealways is false and autonomous invocation is allowed (platform default). The skill writes persistent state to knowledge/personal/hygiene.md in the workspace — expected for a tracker but worth noting because the data persists across sessions.