Skillv1.0.0

ClawScan security

Trip.Com · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignApr 18, 2026, 12:02 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: This is an instruction-only, informational skill about Trip.com (携程) with no code, no installs, and no requested credentials — its declared purpose matches what it does.
Guidance: This skill is an offline informational reference about Trip.com and appears internally consistent. Benign here means it does what it says — not that the content is authoritative or up-to-date. If you plan to perform bookings or connect accounts, prefer official Trip.com channels and only install skills that explicitly request and justify specific API credentials or network access. If a future version asks for keys, file access, or install scripts, treat that as a new risk and re-evaluate before granting them.

Purpose & Capability: okName/description promise an informational overview of Trip.com; the skill only contains a written company/travel-service summary and read_when triggers that match that purpose.
Instruction Scope: okSKILL.md is purely descriptive and contains no runtime commands, no file or path references, and no instructions to read environment variables or transmit data to external endpoints.
Install Mechanism: okNo install spec and no code files are present; nothing will be written to disk or fetched at install time.
Credentials: okThe skill requests no environment variables, credentials, or config paths — consistent with an informational/reference skill.
Persistence & Privilege: okNo always:true, no persistence or modifications requested; the skill is user-invocable only and does not ask for elevated agent privileges.