Skillv1.0.0

ClawScan security

Taiwan · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 11, 2026, 4:29 PM

Verdict: benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's files, runtime instructions, and requested config path are coherent with a travel-planning purpose and do not request unrelated credentials or installs.
Guidance: This skill appears internally consistent for travel planning: it only asks to store trip memory in ~/taiwan/ and otherwise requires nothing. Before installing, confirm you are comfortable with the skill creating and updating files under ~/taiwan/ (check the memory.md contents if you want to avoid storing sensitive data). The skill states it will not make network requests or read files outside that directory—platform enforcement matters here, so if you need stricter guarantees, review platform policies for skill sandboxing. If you plan to let the agent invoke skills autonomously, remember that this skill can be called by the agent (default); that is normal but means it could write to the local memory directory without prompting.

Purpose & Capability: okName/description (Taiwan trip planning) align with the provided content files (city guides, transport, food, itineraries). The only declared resource is a single config path (~/taiwan/), which matches the stated memory usage and is proportionate to the skill's purpose.
Instruction Scope: okSKILL.md and supporting files instruct the agent to read/write a local memory file under ~/taiwan/ and to consult setup.md when memory is missing. There are no instructions to read other system paths, access unrelated credentials, or make network requests; the skill explicitly asserts it does not access files outside ~/taiwan/ or call external endpoints.
Install Mechanism: okInstruction-only skill with no install spec or code files. Nothing is downloaded or executed; no package registry or remote archive is referenced.
Credentials: okNo environment variables, binaries, or credentials are required. The single required config path (~/taiwan/) is reasonable for storing trip preferences and memory; it does not imply access to unrelated services.
Persistence & Privilege: okThe skill requests a local memory directory only. It is not always-enabled and does not request system-wide modifications or access to other skills' configurations. Autonomous invocation is allowed by default (platform default) but is not combined with elevated privileges or broad credential access.