Skillv1.0.0

ClawScan security

Agent Survival Kit · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignFeb 18, 2026, 9:32 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This instruction-only skill is internally consistent: it manages local budgeting/experiments using workspace files, requests no credentials, and has no install steps.
Guidance: This skill appears to do what it says: local budgeting and experiment tracking. Before installing, confirm you are comfortable storing financial data in your workspace (memory/finances.json and memory/projects.json), and that those files won't be shared or backed up to an untrusted location. If you are concerned about autonomous agents exfiltrating data, consider restricting when the skill can run or review any agent-level integrations that could send workspace files externally. Otherwise the skill is coherent and low-risk.

Purpose & Capability: okName/description match the requested artifacts and behavior: the skill tracks finances, runway, and experiments using local workspace files (memory/finances.json, memory/projects.json, MEMORY.md). It does not ask for unrelated credentials, binaries, or system access.
Instruction Scope: okSKILL.md instructs the agent to read and create specific workspace files and offers CLI-style commands for logging and forecasting. There are no instructions to read arbitrary system files, access environment variables, or transmit data to external endpoints.
Install Mechanism: okNo install spec and no code files — instruction-only skills have a low installation risk because nothing is downloaded or written beyond the workspace files the skill itself manages.
Credentials: noteThe skill requires no environment variables or credentials (proportionate). Note: it stores potentially sensitive financial data in workspace files (memory/finances.json and memory/projects.json), so file-level privacy is the main concern rather than credential access.
Persistence & Privilege: okalways:false and no cross-skill or system-wide modifications. The skill will create and update its own workspace files, which is expected for this purpose and is the only persistent effect.