Back to skill
Skillv1.0.0
ClawScan security
Thailand · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 4, 2026, 7:09 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- This is an instruction-only Thailand travel/relocation guidance skill that is internally consistent — it reads and stores a small local memory folder in the user's home directory and otherwise has no installs, credentials, or network-exfiltration instructions.
- Guidance
- This skill appears to be what it says: a travel/relocation guide for Thailand. Before installing, note that it will create and later read a local folder ~/thailand/ and a memory file (~/thailand/memory.md) to store personal planning context. If you keep sensitive data elsewhere, review/clean that memory file before activation. Confirm the agent asks permission before initializing or silently reading existing files. No external credentials or installers are requested; to remove the skill's persistent data, delete the ~/thailand/ directory (and verify no other files were created). Finally, always re-check visa, legal, and health recommendations against the official sources linked in the skill before making commitments.
Review Dimensions
- Purpose & Capability
- okThe skill's name and description (Thailand travel/relocation guidance) match the provided files and runtime instructions. All content files are travel, visa, cost, and region guidance — nothing requests unrelated capabilities (cloud creds, system services, or external tokens).
- Instruction Scope
- noteRuntime instructions tell the agent to create, read, and update a local memory at ~/thailand/memory.md (including initializing it from memory-template.md). This is coherent with a personalised travel advisor but does mean the agent will read/write files in the user's home directory; the setup flow includes an explicit approval step for initializing memory. The instruction to 'read ~/thailand/memory.md silently' is functional but you should ensure the agent asks consent before reading existing files you consider private.
- Install Mechanism
- okNo install spec, no code files to execute, and no downloaded artifacts. Instruction-only skills are lowest risk for disk writes beyond the explicit local memory files described.
- Credentials
- okThe skill declares no required environment variables, binaries, or external credentials. The only state it requests is a local directory and memory file for convenience; that is proportionate to the stated personalized guidance purpose.
- Persistence & Privilege
- noteThe skill persists a small local state under ~/thailand/ and sets file permissions (chmod 700/600). This is expected for a memory feature but is persistent on the user's filesystem. The skill is not always-enabled and does not request elevated system privileges or modify other skills' configuration.