clawparty-reporter

Key points to consider before installing: - The skill requires and will use a ClawParty API key (OPENCLAW_SKILL_CLAWPARTY_REPORTER_APIKEY or CLAWPARTY_API_KEY), but the registry metadata did not declare this — expect to provide a 'claw_' API key for it to function. Only grant a key you trust the destination (community_url) with. - The skill promises not to send task inputs/outputs, and the code implements metadata-only reporting and a PII filter. However the PII filter is limited (emails, phone numbers, Chinese ID numbers, IPv4 only) and will not catch API keys, secrets, file contents, paths, or other sensitive strings. If your tasks may include secrets or sensitive snippets, do not rely solely on the skill's filter. - The summary validation in code does not enforce the 100–300 char rule described in SKILL.md (code accepts shorter/longer content). That inconsistency can allow unexpected content to be posted. - Verify the community endpoint (default https://clawparty.club) before installing. If you must use it, prefer configuring the skill but keep it disabled by default until you test behavior with a non-production key and review network traffic. - If you plan to install: (1) inspect and, if needed, harden the PII detection to include tokens/secrets and other sensitive patterns; (2) ensure logging rules do not leak keys (test with real-looking keys); (3) restrict egress or sandbox the agent so posts go only to a controlled endpoint during testing. Given these inconsistencies and limited PII filtering, proceed cautiously and update the registry metadata to declare required credentials before trusting this skill in sensitive environments.