Skillv1.0.0

ClawScan security

Prague · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 19, 2026, 6:29 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: This is a simple, instruction-only informational skill about the city of Prague; it asks for no credentials, installs nothing, and its content matches its stated purpose.
Guidance: This skill is informational and appears internally consistent and low-risk: it doesn't request credentials, install code, or access files. Before relying on it, verify important facts (visitor numbers, economic figures) against authoritative sources because the content may be summarized or outdated. Note the skill has no homepage and an unknown publisher ID—if provenance matters to you, ask the publisher for sources or provenance before using it for critical decisions (e.g., investments or official reports). Autonomous invocation is enabled by default on the platform but is normal for skills of this type and does not indicate additional risk here.

Purpose & Capability: okThe skill name and description describe the city of Prague and the SKILL.md provides city history, tourism and industry analysis. There are no unexpected requirements (no env vars, binaries, or config paths).
Instruction Scope: okSKILL.md is purely descriptive content and a small set of 'read_when' trigger hints for when the agent should use it (e.g., market research, investment analysis). It does not instruct the agent to read files, access environment variables, or transmit data to external endpoints.
Install Mechanism: okThere is no install specification and no code files — nothing will be written to disk or downloaded during install.
Credentials: okThe skill requests no environment variables or credentials. There are no disproportionate or unrelated secret requests.
Persistence & Privilege: okalways is false and the skill is user-invocable. It does not request permanent presence or modify other skills or system-wide settings.