Back to skill
Skillv1.0.0
ClawScan security
Smart Memory Query · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignFeb 25, 2026, 11:10 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's instructions, requirements, and behavior are internally consistent with its stated purpose (proactive, query-optimized memory_search), with no extra credentials or installs requested — but it is configured to always be active, which has implications you should understand before enabling it.
- Guidance
- This skill is coherent and lightweight: it only instructs the agent how and when to call memory_search and requests no credentials or installs. The main thing to consider before installing is the always: true setting — the skill will be loaded for every agent session and may cause the agent to run additional memory_search queries automatically (which can increase compute, latency, and the surface area for any data pulled from your memory store). If you are concerned about cost, noise, or privacy, either disable or request a version without always: true, or limit when the skill may be activated. Also review how your memory_search implementation handles sensitive data so automated searches do not inadvertently surface secrets.
Review Dimensions
- Purpose & Capability
- okName and description match the SKILL.md: the skill exists solely to enforce when and how to call memory_search. It does not request unrelated binaries, environment variables, or config paths.
- Instruction Scope
- okRuntime instructions are narrowly focused on building and issuing small, targeted memory_search calls based on clear triggers (prior context, new tasks, proper nouns). The instructions do not ask the agent to read unrelated files, access other system state, or transmit results to arbitrary external endpoints.
- Install Mechanism
- okInstruction-only skill with no install spec or code files; nothing is written to disk or fetched at install time.
- Credentials
- okThe skill requires no environment variables, credentials, or config paths, which matches its stated purpose of shaping memory_search behavior.
- Persistence & Privilege
- noteThe skill sets always: true which forces it to be included in every agent run. That is explainable given the skill's aim to enforce proactive searches, but it does increase the skill's runtime presence and the number of memory_search calls the agent may make. Consider whether you want this behavior globally enabled.