Clarity Research

PassAudited by ClawScan on May 1, 2026.

Overview

This skill appears to do what it says: query Clarity Protocol protein-variant data, with an optional API key for higher rate limits.

This looks safe for its stated research-query purpose. Install it only if you are comfortable with requests going to clarityprotocol.io, and use a dedicated Clarity API key if you choose to enable higher rate limits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If you set CLARITY_API_KEY, that key will be sent to clarityprotocol.io when the script makes API requests.

Why it was flagged

The skill can read an optional Clarity API key from the environment and send it as an API header. This is disclosed and purpose-aligned for higher API rate limits, but users should recognize that a credential may be used.

Skill content

api_key = os.environ.get("CLARITY_API_KEY")
if api_key:
    headers["X-API-Key"] = api_key

Recommendation

Use only a dedicated Clarity Protocol API key, avoid putting unrelated secrets in CLARITY_API_KEY, and verify the provider before enabling the key.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

You have less registry-level information to confirm who published the skill or where its code came from.

Why it was flagged

The registry metadata does not provide a source repository or homepage, even though the skill represents itself as a Clarity Protocol integration. This is a provenance gap, not evidence of malicious behavior.

Skill content

Source: unknown
Homepage: none

Recommendation

Before using an API key, confirm that the skill and clarityprotocol.io are the intended provider and review the included code if provenance matters to you.