Skillv1.0.0

ClawScan security

Norway · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 9, 2026, 3:18 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill is an instruction-only Norway travel planner that stores trip memory under ~/norway/ and its requested resources and behaviors align with that purpose.
Guidance: This skill appears coherent and low-risk for trip planning. Before installing: (1) confirm you are comfortable with persistent local storage — the skill will read/write ~/norway/memory.md; (2) do not store sensitive secrets (passport numbers, payment card details) in the memory file; (3) note the skill states it will not make network requests — if you see behavior that fetches external URLs, treat that as unexpected; (4) if you prefer no persistence, create the skill but do not allow it to write files or manually clear ~/norway/ after use. If you want higher assurance, inspect ~/norway/memory.md after first run and review its contents and permissions.
Findings: [none-detected] expected: No code files were present and the regex-based scanner had nothing to analyze. For an instruction-only travel guide this is expected.

Purpose & Capability: okName and description (Norway trip planning) match the files and runtime needs. The only explicit runtime requirement is a per-skill config path (~/norway/) to store trip memory, which is appropriate for a travel-planning memory feature.
Instruction Scope: noteSKILL.md and related files instruct the agent to create and read ~/norway/memory.md and otherwise operate from the included guidance files. The manifest repeatedly references official web sources for verification, but the skill claims it does not make network requests — this is consistent if the agent only prompts users to check those sites rather than fetching them itself. The primary runtime action is local read/write under ~/norway/.
Install Mechanism: okThere is no install spec and no code to run — instruction-only content. This is the lowest-risk pattern: nothing is downloaded or executed by the skill itself.
Credentials: okThe skill requests no environment variables, no binaries, and only a single config path (~/norway/). Those requirements are proportional to a travel-planning memory store and are justified by the stated purpose.
Persistence & Privilege: noteThe skill persists durable trip context in ~/norway/memory.md. always:false (normal) and model invocation is allowed (platform default). Persisting user trip details locally is expected, but users should be aware the skill retains that data until they delete or modify the folder.