Skillv1.0.0

ClawScan security

Finland · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

BenignMar 9, 2026, 1:35 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is internally consistent: it is an instruction-only Finland travel guide that reads and stores trip memory under ~/finland/ and does not request external credentials or installs.
Guidance: This skill appears coherent and is instruction-only: it will create and read a local folder ~/finland/ (memory.md) and does not request credentials or network access. Before installing, verify there is no sensitive data in ~/finland/ (or pre-create the directory with only the fields you want the skill to see). If you prefer the agent to always ask before reusing local trip memory, either review the skill's behavior after installation or restrict autonomous invocation (disable model invocation) according to your agent platform's settings.

Review Dimensions

Purpose & Capability: okThe requested artifact (a config directory ~/finland/) and the instructions to create/read a memory file match the stated purpose of keeping trip context and providing localized Finland planning guidance. No unrelated binaries, environment variables, or external credentials are requested.
Instruction Scope: noteAll runtime instructions are confined to reading/writing files inside ~/finland/ and to consulting the bundled markdown files. One privacy-relevant instruction: setup.md directs the agent to 'read it silently' when ~/finland/memory.md exists, which means the agent may load stored trip context without re-asking the user. The skill explicitly states it will not access files outside ~/finland/ or make network requests.
Install Mechanism: okThere is no install spec and no code files — this is instruction-only. Nothing will be downloaded or written to disk by an installer beyond explicit file operations within the declared ~/finland/ path.
Credentials: okNo environment variables or external credentials are required. The single declared configuration requirement (~/finland/) is proportionate to a skill that stores local trip memory.
Persistence & Privilege: noteThe skill persists memory under ~/finland/ and instructs the agent to read/update that file. always is false (good). The skill can be invoked autonomously (platform default); combined with the 'read silently' behavior, this means an agent could access locally stored trip details without additional prompts. This is expected for a memory-style skill but is a privacy consideration.