Craft Connect
PassAudited by ClawScan on May 10, 2026.
Overview
The visible artifacts describe a coherent Craft API helper, but it uses a stored Craft link token and can read, change, or delete Craft documents.
Install only if you want your agent to access and modify your Craft workspace. Keep the Craft Connect URL private, use the narrowest Craft link available, and confirm document IDs and destructive actions such as deletes or moves.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent could change, move, or trash Craft documents if directed incorrectly.
The skill openly documents broad API authority, including create, read, update, and delete operations. This is aligned with the Craft document-management purpose, but wrong IDs or unintended commands could modify workspace content.
Operate on a Craft space via the Craft Connect REST API. Full CRUD on documents, blocks, folders, tasks, collections, and comments.
Use clear document IDs and ask the agent to confirm destructive or bulk changes before running them.
Anyone or any agent with access to the URL may be able to act through the Craft Connect link.
The Craft Connect URL contains an embedded authentication token. This is expected for the integration, but it is still a credential that grants access to the connected Craft space.
Requires: CRAFT_API_URL (Craft Connect API base URL with embedded link token, stored in TOOLS.md).
Store the URL securely, avoid pasting it into unrelated chats or logs, and rotate or revoke the Craft Connect link if it is exposed.
Users may not realize from registry metadata alone that the skill needs curl and a stored Craft authentication URL.
The metadata says no binary, credential, or config path is required, while SKILL.md requires curl and a CRAFT_API_URL stored in TOOLS.md. This is a disclosure mismatch rather than hidden behavior because SKILL.md states the requirement.
Required binaries (all must exist): none ... Required env vars: none ... Primary credential: none ... Required config paths: none
The publisher should declare the curl dependency and the Craft Connect URL/config requirement in metadata.