Back to skill
Skillv1.0.0
ClawScan security
Personal Love · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 18, 2026, 9:16 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions match its stated purpose — it reads and updates a local knowledge file to track relationship notes — but it persists highly sensitive personal data in the agent workspace, so be mindful of privacy and retention.
- Guidance
- This skill is internally coherent and does what it says: it stores and uses a local file (knowledge/personal/love.md) to remember relationship details. Before installing, consider the privacy implications: the file will contain highly personal information (partners' names, dates, events). Verify where the agent workspace is stored, who/what can read it (other skills, backups, operators), and whether it is encrypted or has retention controls. Remember that the skill's privacy rules are just instructions to the agent and not a technical guarantee. If you proceed, test with non-sensitive example data first, and have a procedure to export or securely delete the knowledge file when you stop using the skill.
Review Dimensions
- Purpose & Capability
- okName/description (relationship/dating assistant) align with what the skill does: read and update a local knowledge file (knowledge/personal/love.md) and use chat history to provide advice and reminders. No unrelated credentials, binaries, or external services are requested.
- Instruction Scope
- noteThe SKILL.md explicitly instructs the agent to read and update knowledge/personal/love.md and to consider chat history. That is appropriate for a memory-backed personal assistant, but it means the skill will persist very sensitive personal information (partners' names, dates, events) in the agent workspace. The 'maximum privacy' rule is a guideline in the instructions — it cannot be enforced by the skill itself.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files — lowest install risk. Nothing is downloaded or written by an installer.
- Credentials
- okNo environment variables, credentials, or external endpoints are requested. The lack of extra secrets is appropriate for the stated purpose.
- Persistence & Privilege
- noteThe skill persists data to the agent workspace (knowledge/personal/love.md). It does not request always:true or elevated privileges, but persisting sensitive relationship data is an inherent privacy risk the user should consider (access by other skills, backups, or humans who can read the workspace).