PagePop
PassAudited by ClawScan on May 8, 2026.
Overview
PagePop appears to be a coherent PagePop integration, but users should notice that it stores a local PagePop access key, keeps conversation state, and sends prompts/links to PagePop.
This skill looks purpose-aligned for PagePop content generation. Before installing, be comfortable with authorizing PagePop once, storing a local access key, sending prompts and links to PagePop, and reusing saved conversation context by default. Use new-chat for unrelated work and verify any update downloads before installing them.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone with access to the local state may be able to use the user's PagePop authorization until it is revoked or reset.
The skill stores a reusable PagePop access key locally after user authorization. This is expected for a PagePop integration, but it is credential-like state that should be protected.
After authorization, the skill stores a local access key and reuses it for later requests.
Authorize only from a trusted device and host app, protect the local state directory, and revoke or reauthorize PagePop access if the device or state file may be exposed.
A later PagePop request may reuse prior conversation context unless the user or host starts a new conversation.
The skill keeps conversation state and defaults to continuing the active conversation. This is useful for continuity, but it means prior conversation context can affect later requests.
Continue the current PagePop conversation by default. ... List locally saved conversations for switch-chat flows.
Use the new-chat option for unrelated or sensitive work, and review saved conversation choices before continuing an existing chat.
Prompts, referenced links, and generated-content context may be processed by PagePop's service.
The skill sends the user's generation request and optional links to the PagePop API. This is central to the skill's purpose, but it is still external service use.
`POST /v2/chat` ... "msg": "Generate an investor deck about our AI product", ... "links": ["https://example.com/reference"]
Do not submit confidential content or private links unless sharing them with PagePop is acceptable, and verify the configured PagePop API base URL is trusted.
A user or host may be prompted to download an updated skill package from a release URL.
The skill can report remote update metadata, including download URLs and hashes, but the artifact states it does not automatically install updates.
当前这是“更新通知”机制，不是自动安装机制。skill 只输出 `skill_update_available` 或 `skill_update_required` ... 下载、SHA-256 校验、解压安装、以及重启 skill 进程由宿主或用户完成。
Install updates only from the expected PagePop release source and verify the provided SHA-256 before replacing the skill.