Back to skill
Skillv1.0.0
ClawScan security
Brazil · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 3:36 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction‑only Brazil travel guide that stores trip memory under ~/brazil/ and does not request extra credentials, network access, or unusual installs — its requested footprint matches the stated purpose.
- Guidance
- This is an instruction-only travel guide that keeps its state locally in ~/brazil/. It does not request credentials or network access. Before installing, consider: (1) the skill will read and update ~/brazil/memory.md (which may contain PII like passport/nationality) — store only what you're comfortable keeping locally; (2) ensure that ~/brazil/ permissions and any host sync/backup (e.g., cloud backup of your home directory) meet your privacy expectations; (3) to remove data later, delete ~/brazil/; and (4) the agent may autonomously consult the local memory when invoked, so review memory-template.md to see what will be stored.
Review Dimensions
- Purpose & Capability
- okName/description (Brazil trip planning) align with the files and the single required config path (~/brazil/). No unrelated env vars, binaries, or cloud credentials are requested.
- Instruction Scope
- noteRuntime instructions are limited to reading/writing the skill's content and a local memory file at ~/brazil/memory.md. Setup.md recommends running mkdir -p ~/brazil and saving trip context; the skill explicitly says it will not access files outside ~/brazil/ or make network requests. Reading the memory file 'silently' could contain sensitive PII (passport, nationality) so users should be aware the agent will reuse that local context.
- Install Mechanism
- okNo install spec or code to fetch/execute remotely; skill is instruction-only and does not write additional binaries to disk beyond the local memory file it asks to create.
- Credentials
- okNo environment variables, no credentials, only a single config path (~/brazil/) which is proportionate to storing trip memory and local state.
- Persistence & Privilege
- okalways is false (not force-included). The skill requests local persistence in ~/brazil/ (memory.md), which is appropriate for a trip-planning skill and does not alter other skills or system-wide settings.