Let's Clarify
v1.0.7Collect structured human input — approvals, decisions, reviews, data — via web forms. Create a form with a JSON schema, send unique URLs to humans, poll for...
⭐ 2· 619·3 current·3 all-time
byHeiko Seebach@heisee
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (collect structured human input via web forms) matches the declared primary credential (LETSCLARIFY_API_KEY) and the SKILL.md: all API endpoints, MCP tools, webhooks, and embed widget behavior are consistent with a form-hosting service. No unrelated credentials, binaries, or install steps are requested.
Instruction Scope
Instructions stay within the form-collection scope (create forms, add recipients, poll results, delete forms). Two user-visible behaviors to be aware of: (1) Webhook support will POST submission data to any HTTPS webhook URL you provide (so submissions can be forwarded outside your environment); (2) the embed widget loads https://letsclarify.ai/embed.js which executes in client pages (standard for embed widgets but is an external script). Both are expected features but are the main channels by which user data leaves your environment.
Install Mechanism
Instruction-only skill with no install spec or downloaded code. Lowest-risk install profile — nothing is written to disk by the skill itself.
Credentials
Only a single primary credential (LETSCLARIFY_API_KEY) is declared and used. The SKILL.md references only that API key for Authorization; no unrelated secrets or config paths are requested.
Persistence & Privilege
always is false and the skill is user-invocable. It does not request persistent system-wide privileges or modification of other skills. By default the agent can invoke the skill autonomously (platform default) — this is normal but should be noted by administrators who restrict autonomous network access.
Assessment
This skill appears to do what it claims: create forms, give per-recipient URLs, poll results, support webhooks and an embeddable script. Before installing or enabling it for an agent, consider: 1) API key risk: the LETSCLARIFY_API_KEY grants create/read/delete access to your forms and submissions — treat it like any service secret and only give it to agents you trust. 2) Data exfiltration channels: if you use webhook_url, submission data will be POSTed to the URL you supply; only provide webhooks you control and trust. 3) Embed script: embedding loads external JS (https://letsclarify.ai/embed.js) into pages — if you serve sensitive content, review the embed behavior and host pages accordingly. 4) Retention: limit retention_days and delete forms when finished to reduce stored data. 5) Autonomy: the skill can be invoked autonomously by default; if you don't want automated agents creating forms or polling results, restrict model invocation or withhold the API key. Overall the skill is internally consistent — these are operational/privacy considerations rather than technical incoherence.Like a lobster shell, security has layers — review code before you run it.
agent-toolsvk9785s67hazq1z2dx0fme4f21d82sqt0approvalvk9785s67hazq1z2dx0fme4f21d82sqt0automationvk9785s67hazq1z2dx0fme4f21d82sqt0confirmationvk9785s67hazq1z2dx0fme4f21d82sqt0data-collectionvk9785s67hazq1z2dx0fme4f21d82sqt0formsvk9785s67hazq1z2dx0fme4f21d82sqt0hilvk9785s67hazq1z2dx0fme4f21d82sqt0hitlvk9785s67hazq1z2dx0fme4f21d82sqt0humanvk9785s67hazq1z2dx0fme4f21d82sqt0human-in-the-loopvk9785s67hazq1z2dx0fme4f21d82sqt0human-in-the-loop human loop forms workflow approval agent-tools data-collection confirmation user-input automationvk9773fypqz8bwevpv5m82r8pp981efnrlatestvk9785s67hazq1z2dx0fme4f21d82sqt0loopvk9785s67hazq1z2dx0fme4f21d82sqt0user-inputvk9785s67hazq1z2dx0fme4f21d82sqt0workflowvk9785s67hazq1z2dx0fme4f21d82sqt0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
📋 Clawdis
Primary envLETSCLARIFY_API_KEY