v1.0.0

Indexy

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:49 AM.

Analysis

Indexy is a coherent instruction-only API skill for managing crypto indices, but it uses account/Web3 authentication and can create or rebalance remote indices, so users should confirm write actions.

GuidanceBefore installing, be aware that this skill is not just for reading analytics: it can use Indexy credentials to create or modify indices on the remote service. Only provide credentials you are comfortable using for this purpose, verify the API domain, and require clear confirmation before any create, update, or rebalance request.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

SKILL.md

**Tool:** `update_index` ... **Endpoint:** `PATCH /beta/indexes/agent/{indexId}` ... "Full rebalance ... replaces the entire asset composition"

The skill documents authenticated write operations that can materially change a user's remote crypto index composition. This is aligned with the skill's stated purpose, but users should notice that updates are not read-only.

User impactIf used incorrectly, the agent could create or rebalance an index in a way the user did not intend.

RecommendationConfirm the target index, assets, weights, and whether the request is metadata-only or a full rebalance before allowing write actions.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityLowConfidenceHighStatusNote

SKILL.md

Include your API key as a Bearer token... `Authorization: Bearer agent_your_key_here` ... "Web3 Authentication" ... `x-web3-signature`

The skill requires service credentials or Web3 signatures to authenticate to Indexy. This is expected for account-specific index management and is disclosed in the instructions.

User impactThe credential or signature authorizes actions on the user's Indexy account or Web3 identity.

RecommendationUse a dedicated least-privilege API key where possible, keep it out of chat transcripts and logs, and only send it to the documented Indexy domains.