Meerkat Governance

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent governance API integration, but users should know it sends selected content to Meerkat and uses a Meerkat API key.

This skill appears coherent and purpose-aligned. Before installing, confirm you are comfortable sending selected prompts, outputs, and source data to Meerkat, protect the MEERKAT_API_KEY, and review the provider’s audit-retention and privacy terms for sensitive use cases.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Potentially sensitive healthcare, financial, legal, or business content may be sent to Meerkat if the agent or developer chooses to verify it.

Why it was flagged

The skill sends user requests, AI outputs, and source data to an external provider endpoint, which is central to the stated governance purpose but still creates an external data boundary.

Skill content

curl -s -X POST https://api.meerkatplatform.com/v1/verify ... -d "{\"input\": \"<USER_REQUEST>\", \"output\": \"<AI_OUTPUT>\", \"context\": \"<SOURCE_DATA>\", \"domain\": \"<DOMAIN>\"}"

Recommendation

Only send content that is appropriate for Meerkat to process, and review the provider privacy policy before using it with sensitive data.

Info

#ASI03: Identity and Privilege Abuse

What this means

If the API key is exposed, another party could use the Meerkat account quota or access account-linked audit records permitted by that key.

Why it was flagged

The integration requires a bearer API key for Meerkat, which is expected for this service but should be treated as an account credential.

Skill content

-H "Authorization: Bearer $MEERKAT_API_KEY"

Recommendation

Store the key securely, avoid pasting it into prompts or shared files, and rotate it if it may have been exposed.

Low

#ASI06: Memory and Context Poisoning

What this means

Audit metadata and session history may be retrievable later through the Meerkat API.

Why it was flagged

The artifacts disclose provider-side audit records and session linkage. This is purpose-aligned for governance, but it means metadata and linked verification history may persist outside the local agent.

Skill content

Every shield and verify call is logged with an audit ID. The `/v1/audit/<audit_id>` endpoint retrieves the full record. Add `?include_session=true` to see all linked attempts in a retry session.

Recommendation

Understand what audit metadata is retained and who can access it under the API key before using the skill for sensitive workflows.