Pre-Publish Fact Checker

PassAudited by ClawScan on May 11, 2026.

Overview

This skill appears purpose-aligned for fact-checking drafts, with the main considerations being its use of a Prismfy API key, external API calls, and an optional reminder hook.

Install if you are comfortable using Prismfy for claim verification. Use a revocable API key, avoid checking key-bearing shell files into source control, review evidence links before publishing, and enable the hook only if you want recurring fact-check reminders in future agent sessions.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The key can access the user's Prismfy account or quota, and storing it in a shell profile may expose it if dotfiles are shared or the machine is compromised.

Why it was flagged

The setup asks the user to provide and persist a Prismfy API key so the helper can authenticate.

Skill content
echo 'export PRISMFY_API_KEY="ss_live_your_key_here"' >> ~/.bashrc
Recommendation

Use a revocable or scoped key if available, avoid committing shell profiles, and remove or rotate the key when no longer using the skill.

What this means

Unpublished draft claims may leave the local environment and be processed by Prismfy for search verification.

Why it was flagged

The helper sends the claim text to Prismfy's external search endpoint using the user's bearer key.

Skill content
body=$(jq -n --arg q "$claim" ...); resp=$(curl -sS -X POST "$SEARCH_ENDPOINT" ... -H "Authorization: Bearer $PRISMFY_API_KEY" ... -d "$body")
Recommendation

Use the skill only for drafts you are comfortable sending to Prismfy, redact sensitive internal details, and ensure any PRISMFY_BASE_URL override points to a trusted endpoint.

What this means

Future agent sessions may be reminded to run claim verification when drafts contain external factual statements.

Why it was flagged

If the optional hook is enabled, it injects a virtual reminder into agent bootstrap context.

Skill content
event.context.bootstrapFiles.push({ path: "CLAIM_VERIFIER_REMINDER.md", content: REMINDER_CONTENT, virtual: true })
Recommendation

Enable the hook only if you want this recurring behavior, and disable it if you prefer to invoke fact-checking manually.