Back to skill
Skillv1.0.0
ClawScan security
Indonesia · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 11, 2026, 5:37 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is a coherent, instruction-only travel planning skill that stores lightweight trip memory under ~/indonesia/ and otherwise stays local; nothing requested is disproportionate to its stated purpose.
- Guidance
- This skill appears internally consistent for travel planning. Before installing: (1) Decide whether you’re comfortable with the skill creating and updating files in ~/indonesia/ (it stores trip notes and activation preferences there). (2) If you prefer not to persist trip data, tell the skill to operate 'only when I ask' or decline creation of local memory. (3) Confirm you trust the skill not to access other files or the network (the SKILL.md claims it won’t). (4) If you want extra caution, inspect the ~/indonesia/ files the first time they are created and back them up or remove them when you’re done.
Review Dimensions
- Purpose & Capability
- okName and description match the actual behavior: travel planning for Indonesia. The only declared external requirement is a local config path (~/indonesia/) used as the skill's memory store, which is reasonable for a trip-planning skill.
- Instruction Scope
- noteSKILL.md confines actions to reading/writing files under ~/indonesia/ and to using the included topic files; it explicitly states it will not access files outside that directory or make network requests. The runtime instructions ask the agent to prompt users about activation preferences, which gives some discretion but is documented and constrained. Users should be aware the skill may create and update files in ~/indonesia/ when asked to maintain continuity.
- Install Mechanism
- okNo install spec and no code files — instruction-only — so nothing is downloaded or written to the system beyond the local memory directory the skill intentionally uses.
- Credentials
- okNo environment variables, no credentials, and the single required config path (~/indonesia/) is proportionate to the purpose of storing trip memory and activation preferences.
- Persistence & Privilege
- noteThe skill stores local memory under ~/indonesia/ when the user opts in; it is not always-enabled and does not request elevated privileges. The skill can be invoked autonomously by the agent (normal platform default) but its described activation flow recommends asking the user and treats 'only when I ask' as the safe default.