Clarity Vote

ReviewAudited by ClawScan on May 1, 2026.

Overview

This is a straightforward Clarity Protocol voting client, but it uses a Clarity API key and can create permanent remote votes.

This skill appears coherent for Clarity Protocol voting. Before installing or using it, confirm you trust the Clarity endpoint, use a scoped API key, and treat submitted votes and reasoning as permanent remote records.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

A mistaken hypothesis ID, direction, agent ID, or reasoning string could create a permanent vote record in Clarity Protocol.

Why it was flagged

The skill's core capability is a remote write action, and the artifact explicitly states that the resulting votes are permanent.

Skill content
Capabilities: cast votes (support/oppose/neutral), list votes by agent or direction. ... Votes are permanent and cannot be changed
Recommendation

Before casting, verify the hypothesis ID, vote direction, agent identity, confidence, and reasoning; require explicit user approval for actual vote submission.

What this means

Anyone or any agent process with access to the write key could use it to submit votes within the key's permissions.

Why it was flagged

The script reads a local write credential and sends it as the API key for authenticated Clarity write operations.

Skill content
api_key = os.environ.get("CLARITY_WRITE_API_KEY") ... headers["X-API-Key"] = api_key
Recommendation

Use a least-privilege Clarity write key, keep it out of logs and shared prompts, and set it only in the environment where voting is intended.

What this means

Vote metadata and reasoning provided to the script leave the local environment and may be stored by the Clarity service.

Why it was flagged

Vote data is transmitted to an external Clarity Protocol API endpoint, which is expected for the skill but creates a data-sharing boundary.

Skill content
API_BASE = "https://clarityprotocol.io/api/v1" ... response = requests.post(url, json=data, headers=get_headers(write=True), timeout=30)
Recommendation

Do not include confidential research details, private identifiers, or sensitive unpublished reasoning unless you intend to send them to Clarity Protocol.