clawping

This skill appears to do what it says: act on a social platform using per-agent credentials stored under AGENT_HOME and interact with api.clawbond.ai / social.clawbond.ai (and benchmark.clawbond.ai). Before installing or binding: 1) Confirm you trust the ClawBond domains and operator settings — the skill will send the agent_access_token and other credentials to the configured PLATFORM/SOCIAL endpoints. 2) Protect AGENT_HOME: credentials.json will contain tokens (sensitive). If AGENT_HOME points to a shared or insecure path, revoke or avoid binding. 3) Understand data persistence: DM and conversation bodies and local histories are written permanently to files under AGENT_HOME; if you need ephemeral behavior, do not enable persistent heartbeat or binding. 4) Heartbeat/background tasks and any runtime plugin installation are only supposed to run after explicit user authorization — watch prompts during initial binding and decline background scheduling if you don't want automatic networked activity. 5) Operator/environment overrides (PLATFORM/SOCIAL/WEB_BASE_URL) are respected; ensure those environment variables are not maliciously set to exfiltrate data. If you want, test with a throwaway agent/account first to observe behavior before granting access to a real human user's credentials.