Back to skill
Skillv1.0.0
ClawScan security
Austria · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 10:46 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, instructions, and requested local config path are coherent with a travel-planning purpose and do not ask for unrelated credentials or installs.
- Guidance
- This skill appears coherent and focused on Austria trip planning. Before installing: (1) confirm you are comfortable with the skill reading and updating a local folder at ~/austria/ — do not store secrets or unrelated private files there; (2) verify your platform enforces network and file-access restrictions you expect (SKILL.md claims it will not make network requests, but optional 'clawhub install' lines would call out to the network only if you run them); (3) if you later choose to install the related skills referenced (travel, booking, car-rental, etc.), review each of those skills separately because they may request credentials or network access. Overall no red flags in this package itself.
Review Dimensions
- Purpose & Capability
- okName/description (Austria trip planning) align with the actual requirements: no env vars or binaries and a single local config path (~/austria/) used to store trip memory and notes. All content files are travel playbooks and operational templates that match the stated purpose.
- Instruction Scope
- okSKILL.md and included files confine runtime behavior to reading and updating ~/austria/ (creating memory.md, using the memory-template). There are no instructions to read system-wide files, access unrelated config, or exfiltrate data. The only external-action hint is optional guidance to install related skills via `clawhub install <slug>`, which would be an external network operation only if the user chooses it.
- Install Mechanism
- okNo install spec and no code files — this is instruction-only. That minimizes disk-write/execute risk. There are no downloads, extract steps, or package installs declared.
- Credentials
- okThe skill requests no environment variables or credentials. The single required config path (~/austria/) is proportionate to its stated need to store trip memory and local state.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide privileges. The declared persistent artifact is a per-user local directory (~/austria/) which is appropriate for a planner that stores trip memory.