ClawHub
Back to skill
v1.0.0

Umeå Lunch

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 4:54 AM.

Analysis

This skill appears to do what it says: fetch public Umeå lunch-menu data from the disclosed website, with no credential use, persistence, or hidden data access shown.

GuidanceThis is a low-risk, purpose-aligned skill for fetching public lunch menus. Before installing, note that it will make a live request to umealunchguide.se and that the registry does not provide an upstream source or homepage.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation
SeverityInfoConfidenceHighStatusNote
scripts/fetch_lunch.py
url = "https://umealunchguide.se/" ... urllib.request.urlopen(req, timeout=30)

The skill performs a live network request to a fixed, disclosed website. This is expected for the lunch-menu purpose, but users should be aware that invoking it contacts an external site.

User impactWhen used, the skill will contact umealunchguide.se and display data returned by that site.
RecommendationUse it when live menu lookup is desired, and treat the returned restaurant/menu text as external website content.
Agentic Supply Chain Vulnerabilities
SeverityInfoConfidenceMediumStatusNote
metadata
Source: unknown; Homepage: none

The registry metadata does not provide an upstream source or homepage. The included code is small and reviewable, so this is a provenance note rather than a material concern.

User impactUsers have less external provenance information for verifying the skill publisher or upstream project.
RecommendationReview the included script before installing if provenance matters, and ensure python3 is available because the runtime instructions use it.