Back to skill
Skillv1.1.0
ClawScan security
Poe Connector · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 16, 2026, 9:22 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill is internally consistent with its stated purpose (a Poe.com connector): it asks for a Poe API key in the declared config path, ships Python scripts that call Poe via the openai client, and instructs the agent to invoke a local bash wrapper — nothing requested appears unrelated to its purpose.
- Guidance
- This skill appears to do what it says: it runs local Python scripts to call Poe's API and requires a Poe API key in ~/.openclaw/openclaw.json. Before installing, consider: (1) any files you attach will be base64-encoded and uploaded to Poe — do not attach sensitive files unless you intend to share them, (2) API calls consume your Poe credits/quotas (the README even admits the author wanted to 'burn through' credits), so expect possible usage/cost, (3) the agent will execute the provided scripts locally (bash/python), so only install if you trust the skill author or have reviewed the code (it's included), and (4) you will need to pip install the public 'openai' package as instructed. If you want tighter control, limit when the agent can invoke this skill and review the code paths that handle file encoding and downloads.
Review Dimensions
- Purpose & Capability
- okName/description (Poe connector) aligns with the code and instructions. The skill requires a POE_API_KEY stored in ~/.openclaw/openclaw.json (declared config path) and Python/bash to run the included scripts. Requiring the openai Python package is coherent: the code reuses OpenAI client to target Poe's base_url.
- Instruction Scope
- noteSKILL.md requires using the bash/shell tool to run the bundled poe.sh which executes the Python scripts. Those scripts will transmit any files you attach (they base64-encode and upload them to Poe), will auto-download media URLs returned by the service, and will read ~/.openclaw/openclaw.json for the API key. This is expected, but be aware that attaching files results in their content being sent to Poe and that local execution runs code from the skill directory.
- Install Mechanism
- okNo external download/install spec is present; all code is included in the skill bundle. The only install action users are instructed to perform is to pip install the public 'openai' package (requirements.txt), which is normal for a Python-based client.
- Credentials
- okThe skill only requires a single Poe API key (declared via the config path skills.entries.poe-connector.env.POE_API_KEY) and no other credentials. There are no unrelated secrets requested. The scripts read that config file and no other system secrets or tokens.
- Persistence & Privilege
- okalways is false and the skill does not request system-wide persistent privileges. It does not modify other skills' configs and only reads its own declared config path.