Product Hunt Launch

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent Product Hunt stats helper, but users should notice it requires a Product Hunt API token and an unspecified `ph-launch` CLI.

Before installing, confirm that you trust the `ph-launch` CLI you will run and use a limited Product Hunt developer token. The artifacts do not show hidden behavior or destructive actions.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The CLI may be able to access Product Hunt API data associated with the token you provide.

Why it was flagged

The skill requires a Product Hunt API token, which is purpose-aligned for reading launch metrics but still grants access to a user-linked Product Hunt API credential.

Skill content

requires:
      env: ["PH_API_TOKEN"]

Recommendation

Use a dedicated Product Hunt developer token with the minimum needed permissions and revoke it if you stop using the skill.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a different or untrusted `ph-launch` executable is present on your system, the agent could run that instead.

Why it was flagged

The skill expects a `ph-launch` command-line tool, but the provided artifacts contain no install spec or code for that CLI, so users must ensure they are using the intended executable.

Skill content

ph-launch monitor --slug "your-product-slug" --interval 60

Recommendation

Install `ph-launch` only from a trusted source and verify which executable will run before using the skill.