Nosi (Publish contents from AI agents)

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Anything the user asks to publish may become publicly accessible through a permanent link.

Why it was flagged

Publishing to the open web is the stated purpose and is clearly disclosed, but it is a high-impact action if private or sensitive content is provided.

Skill content
Nosi lets you publish text to the open web and get a permanent, shareable URL.
Recommendation

Only publish content the user explicitly wants to make public, and confirm before publishing sensitive, personal, confidential, or proprietary material.

What this means

The API key may allow publishing under the user’s Nosi account or identity.

Why it was flagged

The skill uses a Nosi API key to authenticate publishing requests. This is expected for the service, but users should recognize they are providing account-level publishing authority.

Skill content
If yes: Get the API key from user
4. Publish content with X-API-Key header
Recommendation

Provide only a Nosi API key intended for this service, avoid sharing unrelated credentials, and rotate the key if it is exposed.