Back to skill
Skillv1.0.0
ClawScan security
Self-Improving Proactive Agent · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 15, 2026, 2:19 PM
- Verdict
- Benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is an instruction-only package that consistently documents and limits itself to maintaining local learning and proactive state files under the user's home directory; it requests no credentials, performs no installs, and its required actions are proportionate to its stated purpose.
- Guidance
- This skill is internally consistent and doesn't ask for credentials or network access, but it will create and maintain files in ~/self-improving/ and ~/proactivity/ (and may propose workspace integration files). Before installing, consider: (1) Are you comfortable the agent will write state to your home directory? (2) Back up or inspect those folders after first use to verify contents. (3) If you prefer tighter control, run with autonomous invocation disabled or restrict where the agent may write files (e.g., point the skill to a dedicated directory). If you want to be extra cautious, review the files the skill creates and any proposed workspace integrations before accepting them.
Review Dimensions
- Purpose & Capability
- okThe name/description (self-improvement + proactivity) match the instructions: reading and maintaining local memory and session-state files under ~/self-improving/ and ~/proactivity/. There are no unrelated environment variables, binaries, or external services requested that would be out of scope for this purpose.
- Instruction Scope
- noteThe SKILL.md explicitly instructs the agent to read and write files under ~/self-improving/ and ~/proactivity/ and (optionally) workspace files like AGENTS.md, SOUL.md, etc. This is coherent with the stated purpose but worth noting: the skill will create and modify files in the user's home/workspace. The instructions avoid network calls and do not ask for secrets; they also state hard boundaries (require user consent for external actions).
- Install Mechanism
- okNo install spec, no code files, and no downloads. Instruction-only skills are the lowest-risk install profile since nothing is written to disk by an installer beyond what the agent itself chooses to create according to SKILL.md.
- Credentials
- okNo environment variables, no credentials, and no config paths outside the skill's own documented data directories are required. The metadata's configPaths point to the home subdirectories the skill uses, which is expected for a local-state skill.
- Persistence & Privilege
- okalways is false and the skill does not request special platform privileges. It will persist local state in its own directories, which is appropriate for its function. Note that autonomous invocation (model-invocation enabled by default) could let the agent update these files without each-time user prompting—this is platform normal but worth being aware of.