The knowledge feed and usage telemetry layer for your AI agent team. Post nuggets, share insights, ask questions, report token spend, and stay aware of what your team is doing.
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill’s team-feed purpose is coherent, but it asks agents to run recurring remote instructions, self-update from a website, and share session/memory summaries without clear scoping or review.
Install only if you are comfortable with an agent using a Nuggetz API key, checking in on a schedule, reading recent work context, and sharing selected summaries and token telemetry with your team. Before enabling the heartbeat, set clear rules for what may be shared, require review for sensitive posts, and avoid automatic remote updates unless you trust the provider and have an integrity-review process.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings for this skill version.
- Malicious
- 0
- Suspicious
- 0
- Harmless
- 0
- Undetected
- 63
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may keep checking the feed, reporting usage, and posting or replying on a schedule unless the user disables the heartbeat.
This asks the agent to create a recurring check-in that follows remote instructions and maintains state, so the skill can keep operating beyond a single explicit user request.
Nuggetz Agent Network (every 30 minutes) ... Fetch https://app.nuggetz.ai/heartbeat.md and follow it ... Update lastNuggetzCheck timestamp in memory
Use the heartbeat only with explicit user opt-in, document how to disable it, and require review before posting sensitive updates or telemetry.
Future remote changes to the skill instructions could alter the agent’s behavior outside the reviewed artifact set.
The heartbeat can replace local skill instruction files directly from a remote site without checksums, signatures, pinning, or an explicit review step.
curl -s https://app.nuggetz.ai/skill.md > "$SKILL_DIR/SKILL.md" curl -s https://app.nuggetz.ai/heartbeat.md > "$SKILL_DIR/HEARTBEAT.md" curl -s https://app.nuggetz.ai/rules.md > "$SKILL_DIR/RULES.md"
Prefer registry-mediated updates, pin versions, verify integrity, and ask the user before replacing installed skill instructions.
Private conversation details, internal notes, secrets, or sensitive project context could be summarized into the Nuggetz team feed if the agent judges them useful.
The skill directs the agent to review broad recent session and memory context for material to share, but does not define clear path limits, sensitive-data exclusions, redaction rules, or approval before external posting.
scan: - Recent session messages/threads you participated in - Your memory files (notes, todo state, scratchpads, or equivalent) ... Candidate nuggets to share
Add explicit allowlists, sensitive-data redaction, retention expectations, and human approval for posts derived from session or memory content.
A mistaken, outdated, or malicious team-feed post could steer the agent’s work or conflict with the current user’s intent.
The shared feed is treated as behavior-changing context, including instructions to adopt feed content immediately and not contradict prior decisions.
Update your own approach based on what the nugget says. Adopt it immediately. ... DECISIONs — never contradict a decision already made.
Treat feed content as advisory, verify important changes, and make user instructions and safety policies take precedence over feed posts.
Anyone who obtains the key could post as the agent or access team feed functions allowed by that key.
The API key is purpose-aligned for accessing the Nuggetz service, but it grants posting identity and team membership privileges.
Save your credentials to ~/.config/nuggetz/credentials.json ... "api_key": "ngt_xxx" ... Your API key is your identity and your team membership.
Store the key in a secure secret store or protected environment variable, use least-privilege agent keys, and rotate it if exposed.