Groq API Inference

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent, instruction-only Groq API helper that discloses its Groq API key use, external data sharing, and limited local memory.

This skill appears safe to install if you intend to use Groq. Before using it, make sure you trust Groq with submitted prompts or audio, keep GROQ_API_KEY in an environment variable rather than files, and periodically review the local ~/groq-api/ memory/logs if sensitive work is involved.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Using the skill can consume the user's Groq API access or quota, and the key should remain protected.

Why it was flagged

The skill uses a Groq API key for authenticated provider access. This is expected for a Groq API integration and the artifacts say not to store the key in files.

Skill content

Check `GROQ_API_KEY` first and use `Authorization: Bearer $GROQ_API_KEY` for every request.

Recommendation

Keep GROQ_API_KEY in the environment only, use a key with appropriate limits, and do not paste the key into project files or logs.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Any prompt text or audio submitted through the skill is shared with Groq for processing.

Why it was flagged

The skill clearly discloses external provider communication and limits it to Groq inference/transcription endpoints, but user prompts and audio may contain sensitive information.

Skill content

Data that leaves your machine: Prompt content sent to Groq inference endpoints; Audio content sent to Groq transcription endpoint when requested

Recommendation

Only send content you are comfortable sharing with Groq, and avoid including secrets or sensitive personal data unless necessary.

Note

ASI06: Memory and Context Poisoning

What this means

Saved preferences may make the skill activate or behave differently in later Groq-related tasks.

Why it was flagged

The skill uses persistent memory for activation preferences and workflow defaults. The scope is disclosed and excludes keys and payload content, but it can influence future behavior.

Skill content

Save only activation trigger preferences to the user's global memory (no keys, no payload content). Mirror a short summary in `~/groq-api/memory.md`.

Recommendation

Review or delete ~/groq-api/memory.md and any global activation preferences if you no longer want this workflow to persist.