Back to skill
Skillv1.0.0
ClawScan security
Maps · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 13, 2026, 10:54 AM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requirements and instructions are coherent with a maps/planning helper: it is instruction-only, asks only for a dedicated ~/maps/ config path, and does not request unrelated credentials or installs.
- Guidance
- This skill appears coherent and low-risk in itself, but it will create and use ~/maps/ to store memory (provider defaults, recurring places, run-log). Before installing or using it: (1) confirm that any recurring addresses or place history stored there are approved and that you are comfortable with that local storage; (2) do not put API keys or raw location histories into the memory files—the skill advises against this but it cannot enforce it; (3) when the skill needs to call paid APIs (Google, Mapbox, HERE, etc.) supply credentials only after you review and approve the live-call step; and (4) review the included setup.md and memory-template.md so you control activation and persistence behavior.
Review Dimensions
- Purpose & Capability
- okName/description (place search, geocoding, routing, map links) match the instructions and supporting docs. Declared config path (~/maps/) is consistent with the documented memory files and provider notes. No unrelated binaries or environment variables are requested.
- Instruction Scope
- noteInstructions focus on provider selection, normalization, and safe execution patterns. They explicitly direct the agent to read/write a small config/memory area at ~/maps/ and to consult the included markdown files (setup.md, normalization-guide.md, etc.). This is expected for a stateful maps helper, but the memory can contain sensitive recurring origins/destinations—the skill repeatedly emphasizes asking for user approval before storing or sending sensitive addresses.
- Install Mechanism
- okNo install spec or code files are included (instruction-only). No downloads, packages, or binaries are required, minimizing installation risk.
- Credentials
- okThe skill requires no environment variables or external credentials by default. It documents that paid API calls require user-supplied credentials and warns not to persist API keys in memory. Required config path (~/maps/) is proportionate to the stated purpose.
- Persistence & Privilege
- noteThe skill requests a local config/memory directory (~/maps/) to store activation rules, provider defaults, and recurring places. This persistence is reasonable for the feature set but can hold sensitive location context; the skill's docs instruct not to store API keys and to obtain user approval for recurring places. Skill is not always-enabled and is user-invocable, which is appropriate.