Back to skill
Skillv1.0.0
ClawScan security
Panama · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 3:42 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's files, runtime instructions, and requested config path are consistent with a local Panama trip-planning assistant that stores trip memory under ~/panama/ and does not require external credentials or installs.
- Guidance
- This skill appears coherent and local-first. Before installing: (1) be aware it will create and read ~/panama/memory.md to store trip details — keep sensitive data out of that file if you are concerned; (2) the skill states it makes no network requests, but if you enable autonomous invocation, the agent could read/write that local folder without prompting; (3) if you prefer not to give any persistent local state, decline creation of ~/panama/ or inspect the skill files first. If you want extra assurance, run the skill in a restricted environment or review its files directly (they're all plain markdown).
Review Dimensions
- Purpose & Capability
- okName/description (Panama trip planning) align with requested artifacts: a local memory directory (~/panama/) and a set of travel guidance markdown files. There are no unrelated credentials, binaries, or network requirements.
- Instruction Scope
- noteSKILL.md and setup.md instruct the agent to create and read ~/panama/memory.md and to consult the included markdown files. That is appropriate for a stateful trip planner. Note: the skill explicitly says it will not access files outside ~/panama/ or make network requests — the agent is directed to read existing memory 'silently', which is reasonable but means any personal trip data placed in ~/panama/ will be read without explicit per-use prompts.
- Install Mechanism
- okInstruction-only skill with no install spec and no external downloads. No code is written to disk by an install process beyond creating the user-local memory directory.
- Credentials
- okNo environment variables, credentials, or unrelated config paths are requested. The single required config path (~/panama/) is proportionate for storing trip memory.
- Persistence & Privilege
- okalways is false and the skill only requests a single user-local directory for its memory. It does not request elevated privileges or system-wide changes. The persistent footprint is limited to ~/panama/ as documented.