Hotmention

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent with its purpose, but users should notice the optional HotMention API key, external query sharing, and optional cron-style monitoring tip.

This skill appears safe to install as an instruction-only lead-finding helper. Before using it, decide whether you are comfortable sharing search keywords with web search or HotMention, add the API key only if you want paid mode, and do not create scheduled monitoring unless you explicitly want ongoing scans.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If you add the API key, the agent may make requests to HotMention under your account or plan.

Why it was flagged

The skill can use an external service API key, but it is optional, disclosed, and directly tied to the paid HotMention mode.

Skill content
credentials:
      - key: HOTMENTION_API_KEY
        required: false
        description: "API key from hotmention.com... Optional — free mode works without it."
Recommendation

Only add a HotMention API key if you intend to use paid mode; rotate or remove the key if you stop using the skill.

What this means

Product names, competitor names, or lead-search keywords you enter may be shared with external search/API providers.

Why it was flagged

The skill discloses that search keywords may be sent to either HotMention or normal web search providers, which is expected for the stated lead-finding purpose.

Skill content
**Privacy:** In paid mode, keywords are sent to the HotMention API for scoring. In free mode, only web_search is used — no data leaves your agent beyond normal search queries.
Recommendation

Avoid entering confidential strategy terms unless you are comfortable sending them to the relevant provider, and review HotMention's privacy terms for paid mode.

NoteMedium Confidence
ASI10: Rogue Agents
What this means

If a cron job is set up, monitoring could continue periodically and may keep sending queries to the API.

Why it was flagged

The skill suggests persistent scheduled monitoring. This is purpose-aligned, but persistent automation should not be created without explicit user direction.

Skill content
- In paid mode, set up a cron job for automated monitoring
Recommendation

Set up scheduled monitoring only after explicit approval, with a defined schedule, scope, and documented way to disable it.