Back to skill
Skillv1.2.0
ClawScan security
Human Like Memory · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 31, 2026, 8:45 AM
- Verdict
- benign
- Confidence
- medium
- Model
- gpt-5-mini
- Summary
- The skill's files, instructions, and dependencies are coherent with a local, Node.js-based memory/embedding system; it installs npm packages and downloads a ~200MB model but does not request unrelated credentials or unusual system access.
- Guidance
- This skill appears internally consistent with a local-memory/embedding tool, but note these practical risks before installing: - Dependency and model downloads: install.sh / SKILL.md will trigger npm install (fetching @xenova/transformers and transitive packages) and download a ~200MB model from Hugging Face. That is expected for embeddings but is a supply-chain/network activity — review package-lock.json and the install script if you need to vet dependencies. - Unknown publisher / no homepage: the registry metadata has no homepage and an unfamiliar owner ID. If you require higher assurance, review the code files (they are included) or run installation in an isolated environment/container before enabling on production agents. - Resource/network considerations: first run requires disk (~200–300MB) and network access. If you must avoid outbound downloads, set useVectorSearch=false in config.json or run in an environment with an approved model mirror. - Recommended precautions: inspect install.sh and package-lock.json, run npm install and test scripts in a sandbox, and verify that the behavior (model downloads, cache path) matches your policies. If you are comfortable with npm/Hugging Face dependencies and can sandbox the install, the skill is consistent with its stated purpose.
Review Dimensions
- Purpose & Capability
- okName/description (vector search, compression, injection) match the included code (vector-engine.js, compression-engine.js, injection-engine.js), package.json dependency (@xenova/transformers), and config.json settings. Files and docs implement the advertised features.
- Instruction Scope
- noteSKILL.md and ancillary docs instruct automatic dependency installation and running test scripts (npm install @xenova/transformers; node test-vector-engine.js). Instructions reference downloading a model from Hugging Face and optional local cache settings. All referenced actions are within the skill's stated purpose, but the docs assume the platform will run background installs and model downloads.
- Install Mechanism
- noteThere is no platform install spec, but an install.sh and package.json/package-lock indicate npm-based installs. Installing @xenova/transformers (npm) and downloading the Xenova/bge-m3 model are expected for local embeddings; this is a moderate supply-chain risk (npm packages and model download) but uses standard registries (npm, Hugging Face) rather than obscure hosts.
- Credentials
- okThe skill declares no required environment variables or credentials. Optional env vars in docs (TRANSFORMERS_CACHE, HF_ENDPOINT, NODE_OPTIONS) are reasonable for model caching and performance tuning and are not secrets. No requests for cloud keys or unrelated credentials are present.
- Persistence & Privilege
- okSkill is user-invocable and not forced-always. Installation and model cache are confined to its skill directory and usual caches (~/.cache). It does not modify other skills or request system-wide config changes.