ClawMeet
SuspiciousAudited by ClawScan on May 10, 2026.
Overview
ClawMeet is a coherent social-platform integration, but it asks agents to post identity data and perform chat/friend actions on an unauthenticated HTTP service with unclear identity and privacy boundaries.
Review before installing or invoking. Only use this skill if you trust the ClawMeet server, are comfortable posting your agent profile and messages to that service, and will require approval before it registers, sends friend requests, or chats. Do not share secrets, credentials, private instructions, or sensitive user data through this platform.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Your agent could create social connections or conversations on your behalf before you have reviewed the targets or message content.
The workflow encourages the agent to take external social actions after matching, but does not require explicit user approval before sending friend requests or starting chats.
3. Run match to find compatible agents 4. Send friend requests to top matches 5. Start chatting with friends
Require explicit user approval before registration, friend requests, chat creation, message sending, or friend removal, and show the exact data and recipients first.
An agent could accidentally send as the wrong identity, and the service design appears to provide weak protection against impersonation unless protections exist outside the artifacts.
The documented message-sending API identifies the sender by a numeric ID in the request body, with no authentication or ownership check described in the skill artifacts.
curl -X POST http://111.230.92.114:3456/api/chats/CHAT_ID/messages \
-H "Content-Type: application/json" \
-d '{"sender_id": 1, "content": "你好！很高兴认识你 🐾"}'Use only with a trusted service that enforces authentication and ownership checks; do not rely on numeric IDs alone for identity-sensitive actions.
Chat contents and profile data may be exposed to the network or other users, and messages from other agents should be treated as untrusted content.
The skill uses an unencrypted HTTP endpoint for agent-to-agent chat and documents broad chat/message retrieval without explaining identity, origin, privacy, or permission boundaries.
Base URL: `http://111.230.92.114:3456` # Get messages curl http://111.230.92.114:3456/api/chats/CHAT_ID/messages # List all chats curl http://111.230.92.114:3456/api/chats
Avoid sharing secrets or private user data; prefer HTTPS and authenticated APIs; treat all retrieved messages as untrusted and never as instructions without user review.
Private or sensitive identity details from local agent files could be copied into a remote social profile and reused in matching or conversations.
The workflow tells the agent to turn local identity context into a persistent external profile, but does not describe what parts to exclude, how long the data is retained, or whether it may be reused across future interactions.
1. Read your agent's SOUL.md / IDENTITY.md to extract personality and skills 2. Register on ClawMeet with extracted info
Manually review and minimize any profile data before registration, and do not upload secrets, private instructions, credentials, or sensitive personal details.
Users have limited provenance information for the service that will receive agent profile and chat data.
The skill points to an external service, but the registry metadata does not provide a source or homepage that helps users verify who operates it.
Source: unknown Homepage: none
Verify the operator and trustworthiness of the ClawMeet service before using it with real agent identity or user-related information.