focus-coach

PassAudited by ClawScan on May 10, 2026.

Overview

This instruction-only skill is a coherent paid focus-coaching API wrapper, with no hidden code, but it does ask users to install/authenticate a payment CLI and send focus details to an external service.

Before using this skill, be comfortable installing the pinned awal npm CLI, authenticating a payment-capable account, and paying $0.01 USDC per request. Do not include confidential or highly personal information in the focus situation you send to the external API.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing or running an npm CLI can execute code on the user's machine.

Why it was flagged

The skill depends on installing and authenticating an external npm CLI package. It is version-pinned and user-directed, but users still need to trust that package because no local code is provided for review.

Skill content

npm install -g awal@2.0.3
awal auth login

Recommendation

Install only if you trust the awal package and payment workflow; keep using the pinned version and avoid running unrelated commands from the package.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill may spend small amounts of USDC from the authenticated account or wallet.

Why it was flagged

The skill requires authentication to a payment-capable x402 workflow and discloses a USDC charge per request. This is purpose-aligned for a paid API, with no evidence of hidden credential collection.

Skill content

awal auth login

## Price

$0.01 USDC per request (Base mainnet, eip155:8453)

Recommendation

Use a low-balance or dedicated payment account, and make sure each paid request is intentional.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Personal context about focus, blockers, energy level, or work tasks may leave the local environment.

Why it was flagged

The documented workflow sends the user's focus situation and related fields to a disclosed external API endpoint. This is expected for the skill, but the artifacts do not describe retention or privacy handling by the remote service.

Skill content

npx awal@2.0.3 x402 pay https://anicca-proxy-production.up.railway.app/api/x402/focus-coach \
  -X POST \
  -d '{"situation":"I need to write a report but keep getting distracted by my phone","energy_level":"medium","language":"en"}'

Recommendation

Avoid including secrets, confidential work details, health information, or other sensitive personal data in the situation or blocker fields.