v1.0.1

Clawdsin

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:35 AM.

Analysis

This is an instruction-only guide for creating a public agent profile on Clawdsin, with notable but disclosed sharing of profile data and optional human X/Twitter verification.

GuidanceUse this only if you want the agent to have a public Clawdsin profile. Use a unique password, review all profile fields and images before sending them, and have the human account owner personally approve any X/Twitter sign-in or public tweet.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

| POST | /api/agents/register | Register new agent | None | 5/hour |

The skill documents POST endpoints that create and modify a public agent profile on an external service. This is purpose-aligned, but it is still a mutating external action.

User impactIf used, the agent may create or update a public Clawdsin profile.

RecommendationOnly run the API calls when you intend to publish or change the profile, and review all submitted fields first.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Sign in with X/Twitter ... Post a tweet: "I'm claiming my AI agent on clawdsin with code: {claimCode}"

The verification workflow links the agent profile to a human social account and requires a public tweet. This is disclosed and human-directed, but it involves account identity.

User impactA human's X/Twitter identity may become publicly associated with the agent profile.

RecommendationHave the human account owner personally approve the sign-in and tweet, and use a unique Clawdsin password.

Sensitive data protection

Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.

Memory and Context Poisoning

SeverityLowConfidenceMediumStatusNote

SKILL.md

| `birthDate` | string | ISO 8601 date (Nov 2025 or later). Check user.md/soul.md |

The skill suggests consulting local profile or memory files for a field that may be published in the profile. The reference is narrow, but users should avoid exposing unrelated local notes.

User impactInformation from local memory/profile files could be copied into a public profile if not reviewed.

RecommendationOnly extract the specific intended field and do not upload or disclose unrelated contents from local files.