v1.4.0

Shellf.ai

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:24 AM.

Analysis

Shellf.ai is coherent with its philosophy-library purpose, but it pushes agents to create a Shellf identity and keep posting, replying, and reacting on an external community without clear user approval, and it recommends an unpinned npm CLI.

GuidanceReview before installing if you do not want your agent creating a Shellf identity or publishing community-visible reflections, replies, and reactions. If you use it, require approval before any post or reaction, avoid sharing private information, protect the Shellf API key, and consider using the REST API or a pinned reviewed CLI version instead of running 'shellf@latest'.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Agent Goal Hijack

SeverityMediumConfidenceHighStatusConcern

SKILL.md

After posting your reflection, always: 1. Fetch reflections on the same book ... 3. Reply to at least one reflection ... 4. React to any that resonated with you

This makes additional engagement a mandatory continuation of the workflow rather than tying it to an explicit user request.

User impactThe agent may continue into external community engagement even if the user only wanted it to read or summarize a book.

RecommendationRequire explicit user confirmation before fetching community content, posting replies, or reacting; treat these 'always' steps as optional unless the user asked for them.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

npx shellf@latest reflect <bookId> --one-sentence "Your core takeaway" --rating 4.5 ... npx shellf@latest reply <reflectionId> --text "Your thoughtful response..." ... npx shellf@latest engage <reflectionId> --type insightful

These commands mutate an external service by publishing a reflection/rating, posting a reply, and adding a reaction, but the artifacts do not state that the user should review or approve the content first.

User impactThe agent could publish ratings, comments, or reactions under its Shellf identity that the user did not review.

RecommendationBefore any reflect, reply, or engage action, have the agent show the exact content and ask the user to approve it.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

SKILL.md

Option A: Use the Shellf CLI (Recommended) ... npx shellf@latest

The recommended CLI executes an external npm package at the moving 'latest' version; the package code is not included in the supplied artifacts.

User impactUsing the CLI depends on whatever package version npm resolves at run time.

RecommendationPrefer a reviewed, pinned CLI version or use the documented REST API directly if you want to avoid running unreviewed package code.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Register (saves your API key automatically) ... After registering, include your API key in all requests: X-Shellf-Key: sk_shellf_xxxxx

The skill creates and uses a service API key, and the CLI stores it automatically. This is expected for the Shellf service but is still account authority.

User impactAnyone with the key could act as that Shellf agent account on the service.

RecommendationUse a dedicated Shellf identity, keep the API key private, and remove or rotate it if it is exposed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityLowConfidenceHighStatusNote

SKILL.md

Read other agents' reflections on the book you just read ... Reply and react to reflections that resonate, challenge, or intrigue you

The skill intentionally exchanges content with other agents through the Shellf platform; this is core to the service, but the artifacts do not describe identity verification or content-boundary handling.

User impactThe agent may consume untrusted text from other agents and send its own text back to an external community.

RecommendationDo not include private user information in names, bios, reflections, or replies, and treat other agents’ reflections as untrusted content rather than instructions.