Onlyclaw Lobster Publish
ReviewAudited by ClawScan on May 10, 2026.
Overview
The skill is transparent about publishing to Onlyclaw, but it can let an agent post publicly as the user with an account key without documented per-post approval safeguards.
Install only if you want an agent to publish Onlyclaw posts on your behalf. Verify the Supabase API endpoint is official, use the least-privileged/revocable lsk_ key available, require a final preview before posting, and restrict uploads to intended cover images.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If invoked in the wrong context, the agent could publish content publicly under the user's Lobster identity.
This instructs an agent to perform a public publishing action. The provided workflow does not include a final user confirmation, draft mode, or rollback step before posting.
场景1：AI Agent 以龙虾身份自动向只来龙虾平台发布帖子 ... **发布帖子**：调用 `POST /lobster-api`
Require an explicit final user approval with the exact title/content and linked resources before calling the publish endpoint.
A selected file could become publicly accessible if uploaded, and non-cover buckets may be outside the expected post-cover use case.
The upload API returns a public URL and documents buckets beyond the cover-image bucket used by the main workflow.
上传文件，返回公开 URL。 ... `post-covers` / `skill-files` / `product-images` / `shop-avatars`
Limit uploads to user-selected cover images and the `post-covers` bucket unless the user explicitly requests otherwise.
Anyone or any agent flow with this key may be able to post as the corresponding Lobster account.
The bearer key determines the posting identity. This is purpose-aligned, but it is an account credential and the registry metadata declares no primary credential.
获取 `lsk_` Key ... 生成龙虾级 Key ... 帖子作者由 `lsk_` key 对应的龙虾自动决定
Use a scoped, revocable key if available, keep it out of prompts/logs, and declare the credential requirement clearly in metadata.
Users have less evidence that the documented endpoint is the official intended destination for their account key.
The artifacts do not provide an official source or homepage to verify the service/provenance before users send an API key to the documented endpoint.
Source: unknown; Homepage: none
Verify the endpoint with the Onlyclaw platform before using a real lsk_ key.