Back to skill
Skillv1.0.0
ClawScan security
Minecraft · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 13, 2026, 2:47 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only Minecraft advisor that only reads/writes a small user-scoped folder (~/minecraft/) and otherwise requests no credentials or installs—its behavior is coherent with its description.
- Guidance
- This skill appears coherent and low-risk: it gives Minecraft advice and optionally keeps small local notes in ~/minecraft/ only with your permission. Before enabling persistence, decide whether you want the agent to store recurring preferences or keep sessions stateless. If you permit persistence, inspect the created files to confirm they only contain non-sensitive notes (edition, preferred playstyle, build briefs). If you prefer more control, decline persistence and the skill will operate session-only. Also note the skill's source is listed as unknown—if you want stronger provenance, ask for the publisher or review the homepage content before installing.
Review Dimensions
- Purpose & Capability
- okThe name and description match the actual behavior: a Minecraft-focused guidance skill. It requests no credentials, no binaries, and its declared config path (~/minecraft/) is consistent with a local memory/cache for Minecraft preferences and plans.
- Instruction Scope
- noteThe SKILL.md instructs the agent to optionally create and use files under ~/minecraft/ for persistent memory. The skill repeatedly requires explicit user consent before creating or updating these files, which keeps scope reasonable. There is no instruction to read system-wide configs, secrets, or other unrelated paths.
- Install Mechanism
- okNo install specification and no code files: this is instruction-only, so nothing is downloaded or written by an installer. That is the lowest-risk install posture.
- Credentials
- okThe skill declares no required environment variables, no credentials, and its memory template explicitly forbids storing credentials or paid-account tokens. The requested access (user home subfolder) is proportionate to a local preference/memory feature.
- Persistence & Privilege
- okThe skill does support optional local persistence under ~/minecraft/ but only after explicit user permission (per setup.md). always:false, and it does not request system-wide privileges or modify other skills. Autonomous invocation is enabled by default, which is normal — but the skill's persistent writes are permission-gated.