Skillv1.0.0

ClawScan security

Personal Travel · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 18, 2026, 9:17 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only travel assistant that consistently reads and updates a local workspace file (knowledge/personal/travel.md) to store wishlists, trip history, budgets and document dates; it requests no external credentials or installs and its behavior matches its description, but it will persist personal travel data so consider privacy implications.
Guidance: This skill appears to do what it says and asks for nothing extra, but it will store personal travel data (passport expiry, visas, trip history) in the agent workspace file knowledge/personal/travel.md. Before installing: confirm where your agent stores workspace files and who can read them; avoid putting highly sensitive identifiers (full passport numbers, scanned ID images) into the memory file if you don't want them persisted; be aware the skill may access the internet to check visa rules/prices (so consider network/privacy policies). If you need tighter control, ask the developer to redact or encrypt sensitive fields or keep document details in a secure vault instead of the public workspace.

Purpose & Capability: okThe skill's name and description (personal travel planning, wishlist, documents, history, budgets) align with the runtime instructions and the declared storage file (knowledge/personal/travel.md). No unrelated env vars, binaries, or installs are requested.
Instruction Scope: noteSKILL.md instructs the agent to read and update a single workspace file (knowledge/personal/travel.md) and to check the internet for up-to-date visa/pricing info. Reading/updating that file is coherent with the stated purpose, but this explicitly persists personal document dates and travel history — a privacy consideration.
Install Mechanism: okNo install spec or code is included (instruction-only), so nothing is written to disk beyond the explicitly-named knowledge file in the agent workspace.
Credentials: okThe skill declares no environment variables, credentials, or config paths. It does ask the agent to use the internet for current information, which is proportionate to checking visa rules/prices and does not require extra credentials.
Persistence & Privilege: okalways is false, the skill does not request global/always-on privileges, and its only persistent footprint is the named workspace knowledge file which it explicitly reads/updates (expected behavior for a memory-backed assistant).