v1.3.0

Plotlake

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 7:49 AM.

Analysis

Plotlake is a coherent feed-aggregation skill that uses disclosed curl calls to Plotlake's API, with only normal caution needed around sending feed URLs and managing remote channel subscriptions.

GuidanceThis skill appears safe for its stated purpose. Before installing or using it, be aware that it manages remote Plotlake channels and sends source URLs to api.plotlake.com; avoid submitting private, internal, or token-bearing feed URLs unless you trust that service.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

curl -s -X POST "$BASE/api/open/channels" ... curl -s -X POST "$BASE/api/open/channels/$CHANNEL_ID/subscribe-bundle?bundle_id=ai_starter" ... curl -s -X DELETE "$BASE/api/open/channels/$CHANNEL_ID/sources/$SOURCE_ID"

The skill documents direct API calls that create channels, subscribe bundles, and delete sources on the Plotlake service.

User impactThe agent or user can change Plotlake channel/source state if these commands are run.

RecommendationReview the channel ID, source ID, and intended subscription or deletion before running mutation commands.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Insecure Inter-Agent Communication

SeverityInfoConfidenceHighStatusNote

SKILL.md

**API 地址：`https://api.plotlake.com`** ... 提交任意 URL（RSS 地址、网站首页），系统自动发现 feed

The skill sends configured source URLs and channel requests to an external Plotlake API, which is disclosed and central to the feed-subscription purpose.

User impactPlotlake may receive the feed URLs, channel configuration, and source choices you submit.

RecommendationUse public feed URLs unless you intentionally trust Plotlake with private or tokenized source URLs.