v1.0.0

clawdio

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 5:27 AM.

Analysis

The skill is a coherent paid audio-report API, but using it can automatically spend USDC from an x402 wallet, so it should be reviewed before installation.

GuidanceOnly install or use this skill if you are comfortable with an agent making paid x402 requests. Browse the catalog freely, but require explicit approval for /catalog/purchase requests, use a low-balance or scoped wallet, and save purchased artifacts to avoid repeat charges.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

SKILL.md

Step 3: Purchase a Report ($1.49 USDC) ... curl https://clawdio.vail.report/catalog/purchase?id={uuid} ... Your x402 wallet automatically ... Signs a USDC payment ... Retries the request with the PAYMENT-SIGNATURE header

The documented high-impact action is a simple GET request that may be automatically retried with a signed payment, without an explicit instruction to obtain user approval before spending.

User impactAn agent or integration that follows the purchase URL with an enabled wallet could spend USDC to buy a report.

RecommendationRequire explicit user confirmation before every purchase request, set wallet spending limits, and avoid letting agents auto-follow purchase URLs.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusConcern

SKILL.md

You need an x402-compatible wallet funded with USDC on Base Mainnet ... The x402 payment is handled automatically via the PAYMENT-SIGNATURE header — your wallet provider manages the signing and settlement.

The skill requires delegated wallet authority capable of authorizing crypto payments; the artifacts do not show a scoped wallet, spending cap, or approval boundary.

User impactA connected wallet could be used to authorize payments from the user's funds when the paid endpoint is invoked.

RecommendationUse a dedicated low-balance wallet, verify the Base Mainnet USDC amount before purchase, and disable automatic signing unless each payment is approved.