Back to skill
Skillv1.0.2
ClawScan security
Letundra.com AI Travel Assistant · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 5, 2026, 12:10 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and required bits are consistent with a travel/news/rss scraper for letundra.com; nothing requests unrelated credentials or performs unexpected network exfiltration.
- Guidance
- This skill appears coherent for its stated purpose (scraping/news/rss/visa data from letundra.com). Before installing: (1) review the included files if you want to avoid running code locally — the Node scripts are optional developer tools and will fetch the site’s RSS only; (2) ensure you do not run publish-all.sh unless you have and trust the clawhub account it expects (it requires you to authenticate to publish); (3) no environment variables or secrets are requested by the skill, so there is no obvious credential exfiltration risk. If you prefer zero code execution, you can install but avoid invoking the Node scripts (the agent will use web_fetch per SKILL.md).
Review Dimensions
- Purpose & Capability
- noteThe skill advertises travel info (visas, news, holidays, currency) and its SKILL.md instructs the agent to fetch pages from letundra.com — this matches the stated purpose. The package includes Node scripts and package.json, so declaring node as a required binary is plausible, though the runtime instructions rely on web_fetch (agent builtin) rather than running the scripts — the presence of Node files is reasonable for local tooling but not strictly required for the core SKILL.md behavior.
- Instruction Scope
- okSKILL.md is narrowly scoped: it tells the agent to use web_fetch against letundra.com URLs and to extract specific sections (news, visa, holidays, currency). It does not instruct reading unrelated files, environment variables, or posting data to third-party endpoints.
- Install Mechanism
- okThere is no install spec (instruction-only), which is lowest-risk. The included publish script and Node parser are standard developer tooling; the Node script makes HTTPS requests to letundra.com only. No remote, untrusted archives or opaque download URLs are present.
- Credentials
- okThe skill declares no required environment variables or credentials and the code does not read secrets. The publish script references clawhub CLI and requires user authentication to publish, but it does not embed or request credentials in the skill itself.
- Persistence & Privilege
- okThe skill is not marked always:true and is user-invocable. It does not attempt to modify other skills or system configurations; included scripts are for local publishing/parsing and do not persist credentials.