ClawHub
Back to skill
v1.0.0

Golf Tee Times

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:48 AM.

Analysis

This skill appears to do what it says—search GolfNow tee times—while relying on an unofficial GolfNow API call that users should be aware of.

GuidanceThis skill looks reasonable for finding golf tee times. Before installing, note that it queries GolfNow through an unofficial reverse-engineered API and may send your search location, date, and player count to GolfNow.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation
SeverityLowConfidenceHighStatusNote
golfnow-search.py
subprocess.run([ 'curl', '-s', '-X', 'POST', 'https://www.golfnow.com/api/tee-times/tee-time-results', ... '-d', payload ])

The helper script shells out to curl to call GolfNow's tee-time API with search parameters. This is disclosed and aligned with the skill's purpose, but it means user search details such as date, player count, and location coordinates are sent to GolfNow.

User impactGolf search details may leave the local environment and the unofficial endpoint may change or behave differently from a documented public API.
RecommendationUse the skill only when comfortable sending the requested tee-time search details to GolfNow, and review searches before running them for sensitive locations.
Agentic Supply Chain Vulnerabilities
SeverityInfoConfidenceHighStatusNote
metadata
Source: unknown; Homepage: none

The registry metadata does not provide an upstream source or homepage for provenance review, although the included script is visible and has no external package dependencies.

User impactUsers have less external context for who maintains the skill or where the code originated.
RecommendationReview the included SKILL.md and helper script before installation, and prefer installing from trusted publishers when provenance matters.