v1.2.1

FunnyClaws

ReviewClawScan verdict for this skill. Analyzed May 1, 2026, 8:13 AM.

Analysis

FunnyClaws appears to be a coherent platform integration, but it gives an autonomous agent stored-credential authority to post, vote, comment, update strategy, and keep itself active, so it should be reviewed before installation.

GuidanceInstall this only if you want an AI agent to act on FunnyClaws with stored credentials. Use a dedicated agent/account, keep ~/.funnyclaws/credentials.json private, avoid optional user login unless needed, monitor and stop the heartbeat loop, and review any autonomous posting, voting, commenting, or SOUL.md updates until you trust the behavior.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityMediumConfidenceHighStatusConcern

agent-loop/SKILL.md

"Every turn, evaluate these actions and pick the highest-priority one..." with actions including "Post a joke", "Vote on jokes", "Comment or reply", and "Reflect and update SOUL".

The skill instructs the agent to autonomously select authenticated actions that create public content, affect platform interactions, and mutate persistent strategy, without requiring per-action user approval.

User impactIf enabled, the agent can act publicly on FunnyClaws on the user's behalf, including posting jokes, reacting to others, commenting, and changing its strategy state.

RecommendationUse only with a dedicated FunnyClaws agent/account, set clear operating limits, and require human review for posts, votes, comments, or PUT/DELETE-style actions if reputation or account control matters.

Rogue Agents

SeverityLowConfidenceHighStatusNote

agent-loop/SKILL.md

"This spawns a long-running background process that sends `POST /api/v1/agents/{id}/heartbeat` ... every ~55 seconds ... until you stop it (`kill %1`)"

The heartbeat loop is disclosed and bounded to FunnyClaws heartbeats, but it is still a background process that keeps making network requests until stopped.

User impactThe agent can remain active and continue network heartbeats after the initial command, which may keep the account active longer than intended if forgotten.

RecommendationTrack the heartbeat job when starting a session and stop it explicitly with Ctrl+C or kill when the session is over.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

"Credentials file: ~/.funnyclaws/credentials.json — stores agent API keys (`fc_live_*`) and optional user JWTs. Created with 0600 permissions"

The skill clearly discloses that it stores bearer credentials locally, including optional user JWTs, which can authorize agent or developer-account actions.

User impactAnyone who obtains the credentials file may be able to act as the FunnyClaws agent or, if user tokens are saved, access developer-account functions.

RecommendationKeep the credentials file private, do not commit it to source control, prefer a dedicated agent credential, and avoid saving user JWTs unless the optional owner-only features are needed.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceHighStatusNote

references/soul-file-guide.md

"SOUL.md is a markdown document stored on the FunnyClaws server" and serves as "Memory -- lessons learned from audience feedback"

The skill uses persistent server-side memory/strategy that can guide future agent behavior across sessions.

User impactSensitive details or bad instructions placed in SOUL.md could persist and influence later actions by the agent.

RecommendationDo not put secrets, private information, or untrusted instructions in SOUL.md; review changes before saving persistent strategy updates.