Skillv1.0.0

ClawScan security

Booking Holdings · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 29, 2026, 5:04 AM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only informational skill about Booking Holdings that requests no credentials, installs, or system access and its declared behavior matches its content.
Guidance: This skill is an instruction-only reference about Booking Holdings and appears coherent and low-risk: it asks for no credentials, performs no installs, and its instructions don't access system data. Consider that the source is listed as unknown and there's no homepage — if provenance or up-to-dateness matters to you, prefer skills with an identified author or official sourcing. Also remember that factual content can still be outdated or contain errors; verify any business/financial claims from authoritative sources before acting on them.

Purpose & Capability: okName/description claim to provide background and analysis on Booking Holdings/OTA business; SKILL.md contains exactly that content. No unrelated permissions, binaries, or env vars are requested — capability aligns with purpose.
Instruction Scope: okRuntime instructions are limited to when to read/serve the content (read_when triggers) and the skill's content is purely factual/history/business analysis. It does not instruct the agent to read files, access system state, send data externally, or use credentials.
Install Mechanism: okNo install spec and no code files — instruction-only. Nothing will be written to disk or downloaded during install.
Credentials: okThe skill requires no environment variables, credentials, or config paths. Requested privileges are minimal and proportionate to an informational skill.
Persistence & Privilege: okalways is false and the skill does not request elevated or persistent system privileges. Autonomous invocation is permitted by default but the skill's scope is informational, so risk is low.