Refund Assistant
Security checks across malware telemetry and agentic risk
Overview
The skill’s visible instructions and code match a refund-advice helper, with no evidence of credential use, network calls, or account-changing actions.
This appears suitable for refund-planning use. Do not provide passwords, payment credentials, or unnecessary personal details; if local retention matters to you, check how the host environment handles the referenced LocalStore.
VirusTotal
64/64 vendors flagged this skill as clean.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may rely on platform-provided or shared code that is not shown in the package artifacts.
The included code depends on a shared helper outside the two-file manifest; this is a provenance/review-context note, not evidence of harmful behavior.
const { LocalStore } = require('../../shared/storage/local-store');Install from a trusted registry/source and inspect the shared storage helper if your environment exposes it.
Refund or order details are not visibly stored by this code, but users should be mindful of any local retention behavior in the host runtime.
The skill creates a named local storage object; the provided methods do not write to it, but it indicates a local persistence surface related to refund/order workflows.
this.store = new LocalStore('refund-assistant');Avoid entering unnecessary personal or order details, and ensure any local storage behavior is disclosed if future versions use it.