Clarity Fold Status

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it claims: run a small status check against the Clarity Protocol API, with only minor notes about network access, an optional API key, and under-declared runtime requirements.

This looks safe for checking Clarity Protocol status. Before installing, be aware that it contacts clarityprotocol.io, may use a CLARITY_API_KEY if you set one, and relies on local Python/request-library availability despite the registry not declaring install requirements.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

Using the skill will contact clarityprotocol.io to retrieve status and variant information.

Why it was flagged

The script makes outbound API requests to a fixed Clarity Protocol endpoint, which matches the skill's stated purpose and is disclosed in SKILL.md.

Skill content

API_BASE = "https://clarityprotocol.io/api/v1"

Recommendation

Install only if you are comfortable with the skill making read-only requests to the Clarity Protocol API.

NoteHigh Confidence

ASI03: Identity and Privilege Abuse

What this means

If you set CLARITY_API_KEY, that key will be sent to clarityprotocol.io with the status requests.

Why it was flagged

The script reads an optional API key from the environment and sends it as an API header. This is disclosed for higher rate limits and is scoped to the declared Clarity Protocol API.

Skill content

api_key = os.environ.get("CLARITY_API_KEY")
    if api_key:
        headers["X-API-Key"] = api_key

Recommendation

Use a dedicated, low-privilege API key if available, and set it only when you want authenticated Clarity Protocol requests.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail unless Python and the requests package are already available, or the user may need to install them separately.

Why it was flagged

The artifacts nevertheless include runnable Python scripts, and the code imports requests. This is not suspicious by itself, but the runtime/dependency requirements are under-declared.

Skill content

Required binaries (all must exist): none ... Install specifications: No install spec — this is an instruction-only skill.

Recommendation

Review the included scripts before running them and ensure any local Python dependencies come from trusted sources.