Clarity Literature

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it says: query Clarity Protocol for literature data, with only an optional API key to raise rate limits.

This looks safe to install for searching publication data. Be aware that it makes network requests to clarityprotocol.io, and if you configure CLARITY_API_KEY, that key will be sent to Clarity Protocol for authentication.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you set CLARITY_API_KEY, the key will be used to authenticate requests to Clarity Protocol for higher rate limits.

Why it was flagged

The script reads an optional API key from the environment and sends it as an X-API-Key header to the configured Clarity Protocol API. This is disclosed and purpose-aligned, but it is still credential use that users should notice.

Skill content

api_key = os.environ.get("CLARITY_API_KEY")
if api_key:
    headers["X-API-Key"] = api_key

Recommendation

Only set a Clarity API key you intend to use with this service, keep it out of chat transcripts and logs, and revoke or rotate it if it is exposed.