Back to skill
Skillv1.0.0
ClawScan security
Trip Save · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 1, 2026, 7:35 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and runtime instructions are coherent with its stated purpose (saving and tagging travel inspiration from URLs or text); it has no install steps, does not ask for credentials, and appears internally consistent.
- Guidance
- This skill appears to do only what it says: fetch public URLs or take plain text and save a small tagged record in agent memory. Before installing, consider: (1) Privacy — avoid sending URLs that contain sensitive information or private-account content because the agent will fetch page content and store metadata in memory. (2) Persistence — check your agent's memory retention and who can access it (saved items will persist and may appear in future conversations). (3) Protected content — the skill provides no mechanism for handling login-required or paywalled pages, so those saves may fail silently or save only the link. If you are comfortable with the agent making HTTP requests to the links you provide and storing simple records, this skill is proportionate to its purpose.
Review Dimensions
- Purpose & Capability
- okName/description (save travel inspirations, extract destination and tags, store in memory) match the SKILL.md instructions. There are no unrelated required binaries, environment variables, or installs that would be unexpected for this functionality.
- Instruction Scope
- noteInstructions ask the agent to 'use web search or web fetch to get the page content' and then extract destination/tags and store a short record in memory. This is within purpose, but the fetch step means the agent will make network requests to user-provided URLs and could retrieve page content (which might include PII or private information). The skill does not instruct how to handle login-protected or paywalled content, or whether to store full page text versus only metadata.
- Install Mechanism
- okInstruction-only skill with no install spec and no code files. Nothing is written to disk or downloaded during install, which is the lowest-risk install posture.
- Credentials
- okThe skill requests no environment variables, credentials, or config paths. That aligns with a bookmarking/saving feature that should not need external keys or secrets.
- Persistence & Privilege
- noteThe skill stores saved items in agent memory (persistent by design). 'always' is false (no forced inclusion). Be aware that saved entries will persist according to the agent/platform memory retention and could be exposed in future agent responses or exports — the SKILL.md does not specify retention, redaction, or access controls.