Back to skill
Skillv1.0.0
ClawScan security
Chile · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 10:42 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only Chile trip-planning skill that is internally consistent: it only requires a local ~/chile/ config directory for storing a trip memory and otherwise asks for no credentials, binaries, installs, or network access.
- Guidance
- This skill appears coherent and low-risk: it only reads/writes a local ~/chile/ folder and uses bundled markdown guidance. Before installing, consider: 1) Are you comfortable the agent will create and store trip preferences in ~/chile/? Delete that folder to remove stored memory. 2) Confirm the platform's permission model — ensure the skill cannot access other filesystem locations. 3) The skill claims no network access, but the included sources.md contains links (including a staging URL). If you rely on live rules (entry/visa), double-check official government sites when booking. If those points are acceptable, the skill is fine to install.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description (Chile trip planning) align with its contents: a set of markdown guides and a local memory file. The only requested resource is a config path (~/chile/) which is reasonable for storing trip context.
- Instruction Scope
- noteAll runtime instructions are document-based and limited to reading/writing the declared ~/chile/ memory file and using the bundled markdown files. The skill instructs creating ~/chile/ and silently reading ~/chile/memory.md for returning users — this is expected for a memory-backed planner but has privacy implications (local storage of trip data). The skill also includes a sources.md with many URLs; the skill does not instruct making network requests, but some links point to a staging host (stg.chile.travel) — verify source freshness if that matters.
- Install Mechanism
- okInstruction-only skill with no install spec, no downloads, and no code execution beyond creating/reading a local folder. This is low-risk from an install/execution standpoint.
- Credentials
- okThe skill requests no environment variables, credentials, or external service tokens. The single declared resource (~/chile/) is proportional to its stated purpose of storing per-trip memory.
- Persistence & Privilege
- noteThe skill stores persistent state in its own folder (~/chile/) which is normal for a memory-backed helper. It is not always-enabled and does not request elevated privileges. However, it will read and update files in that folder (including reading memory.md 'silently'), so users should be aware of persistent local data created by the skill and how to remove it if desired.