Happenstance
Analysis
This is a straightforward Happenstance API skill that discloses its use of an API key, network searches, and paid credits, with no hidden code or install behavior shown.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
- **Search**: 2 credits per search (including find-more) - **Research**: 1 credit per completed research
The documented API operations can spend Happenstance credits. The cost is disclosed and purpose-aligned, but users should be aware before allowing multiple searches or research requests.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
All requests require the `HAPPENSTANCE_API_KEY` environment variable. Pass it as a Bearer token:
The skill uses a Happenstance account credential for API access. This is expected for the service, but users should recognize that the agent can make authenticated account requests.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
"include_my_connections": true, "include_friends_connections": true
The skill can query a third-party provider using the user's professional-network connections and friends-of-connections. This is central to the skill, but it involves sensitive relationship data.