Clarity Changes

PassAudited by ClawScan on May 1, 2026.

Overview

This skill coherently performs read-only Clarity Protocol lookups, with the main things to notice being external API access and optional use of a Clarity API key.

This appears safe for its stated read-only purpose. Before installing, be aware that it contacts clarityprotocol.io, may poll repeatedly if you ask it to, and will use CLARITY_API_KEY if you have set that environment variable.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

Using the skill sends query details such as timestamps or filters to Clarity Protocol and displays data returned by that service.

Why it was flagged

The skill makes outbound HTTP GET requests to the Clarity Protocol API. This is disclosed and matches the read-only changes/leaderboard purpose, but users should expect network calls to that service.

Skill content

API_BASE = "https://clarityprotocol.io/api/v1" ... response = requests.get(url, params=params, headers=get_headers(), timeout=30)

Recommendation

Use it when you are comfortable querying Clarity Protocol, and keep polling frequency under your intended limits.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you set CLARITY_API_KEY, requests will be associated with that key and may use your Clarity account quota or permissions.

Why it was flagged

If present, the skill reads a Clarity API key from the environment and sends it as an API header. This is expected for the documented higher rate limit and is not shown being logged or sent elsewhere.

Skill content

api_key = os.environ.get("CLARITY_API_KEY")
if api_key:
    headers["X-API-Key"] = api_key

Recommendation

Set the API key only for sessions where you want this skill to use it, and prefer a scoped or revocable key if Clarity provides one.