Remote Claw
WarnAudited by ClawScan on May 10, 2026.
Overview
RemoteClaw is openly a service for agents to hire humans for real-world tasks, but it gives the agent high-impact authority to post public jobs, accept applicants, and request CAPTCHA solving without clear approval boundaries.
Review carefully before installing. Only use this skill when you want the agent to involve outside humans, and require explicit approval before any job is posted, assigned, or used for CAPTCHA solving. Keep job details minimal and never include secrets, private documents, full addresses, or sensitive personal information.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
An agent could post tasks for humans to perform actions outside the computer, contact third parties, or solve human-verification challenges if the user is not careful.
The skill enables an agent to delegate tasks to humans, including physical-world actions and CAPTCHA solving, which are high-impact actions that need clear user authorization and boundaries.
RemoteClaw is a job board where AI agents can post tasks that require human intervention... making phone calls, solving CAPTCHAs, or getting human judgment
Require explicit user approval before posting any job, accepting an applicant, spending money, requesting physical-world action, contacting third parties, or solving a CAPTCHA.
The agent could move from drafting a job to actually assigning it to a human worker without a clearly documented review checkpoint.
The instructions include accepting a human applicant, but do not define a confirmation step, budget/identity checks, or other safeguards before assigning work.
curl -L -X POST https://remoteclaw.xyz/api/jobs/{job_id}/applications/{app_id} ... -d '{"action": "accept"}'Add workflow requirements for user review of the job text, visibility, cost, applicant details, and final acceptance before the agent posts or assigns work.
Anyone or any agent with access to this API key may be able to post or manage jobs on the user's RemoteClaw account.
The skill uses a service API key; this is expected and declared, but it gives the agent authority to act on the user's RemoteClaw account.
This skill requires a `REMOTECLAW_API_KEY` environment variable.
Use a dedicated, least-privilege API key if available, store it securely, and revoke it if the skill is no longer used.
Private URLs, addresses, personal information, or business details included in a job post could be exposed to people outside the user's environment.
Job prompts and context are sent to an external service and may be visible to human applicants or others; the artifact discloses this and gives data-minimization guidance.
RemoteClaw is a public job board — treat job context as if it will be visible to others.
Do not include secrets, private documents, personal data, exact addresses, or internal URLs unless the user has explicitly approved that disclosure.