Back to skill
Skillv1.0.2
ClawScan security
Daily Task Check-in · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 26, 2026, 8:49 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requested resources and runtime instructions are consistent with its stated purpose; it is an instruction-only, public-safe task reminder template and does not ask for credentials or install anything.
- Guidance
- This skill appears coherent and low-risk, but verify how your host platform will implement the vague pieces before enabling it in production: 1) Confirm where the assistant will 'record' the task list (ephemeral memory vs persistent storage) and how long that data is retained. 2) Confirm how reminders are delivered (internal assistant messages only, or external channels like email/SMS/calendar connectors) and disable any external connectors if you don't want notifications leaving your environment. 3) Test the flow in a sandbox with non-sensitive, dummy tasks to ensure it behaves as expected. If you plan to use real personal or family schedules, ensure the platform's privacy and retention settings meet your needs.
Review Dimensions
- Purpose & Capability
- okName/description match the runtime instructions: intake a same-day task list, confirm start time, send reminders, do a nightly check, and ask about rewards. The skill requests no binaries, env vars, or config paths that would be unrelated to this purpose.
- Instruction Scope
- noteSKILL.md stays within the described task-checkin scope and explicitly forbids sensitive data, but it leaves implementation details unspecified (where/how tasks are 'recorded' and how 'reminders' are delivered/scheduled). That vagueness gives the host agent/platform broad discretion (e.g., using persistent storage, external messaging channels, or platform notifications) which you should confirm before use.
- Install Mechanism
- okNo install spec and no code files — this is instruction-only, so nothing is downloaded or written to disk by the skill itself.
- Credentials
- okThe skill declares no environment variables, credentials, or config paths. There are no requests for keys, tokens, or unrelated service credentials.
- Persistence & Privilege
- okalways is false. The agents/openai.yaml sets allow_implicit_invocation: true (permitting implicit invocation when the host allows it), which is normal for reusable skills. The skill does not request permanent system-wide privileges or modify other skills.