Clawbridge - Find your connections

PassAudited by ClawScan on May 10, 2026.

Overview

This skill is a disclosed chat shortcut for running the external Clawbridge CLI, but users should trust the Clawbridge runner and installer before using it.

This skill looks like an optional shortcut rather than a standalone discovery engine. Install it only if you already trust Clawbridge, are comfortable running the external `clawbridge` CLI from chat, and understand that discovery results are uploaded to Clawbridge Vault.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Installing the runner gives code from clawbridge.cloud the ability to run locally during setup.

Why it was flagged

The required Clawbridge CLI is installed by piping a remote script to a shell. This is a common but sensitive install pattern because the installer contents are not included or pinned in the reviewed artifacts.

Skill content
command: "curl -fsSL https://clawbridge.cloud/install | bash"
Recommendation

Only run the installer if you trust Clawbridge; preferably inspect the install script first and follow any official verification guidance.

What this means

Using the chat command runs the installed Clawbridge CLI on the user’s machine.

Why it was flagged

The skill’s main behavior is to execute a local binary. This is disclosed and central to the skill’s purpose, but it means the external runner, not the skill file, performs the substantive work.

Skill content
1. **Exec**: Run `clawbridge run` locally
Recommendation

Confirm the `clawbridge` binary is installed from a trusted source and understand what the runner does before invoking `/clawbridge`.

What this means

Discovery prompts or results may be processed by OpenClaw and stored in Clawbridge Vault.

Why it was flagged

The external runner sends work through OpenClaw as a worker and uploads results to Clawbridge Vault. This is disclosed and purpose-aligned, but the reviewed artifacts do not show the detailed data boundaries.

Skill content
Runner: Discovery workflow   │  - Build prompts (private)    │  - Call OpenClaw as worker    │  - Upload to Vault
Recommendation

Review Clawbridge’s privacy and workspace settings, and avoid running discovery on sensitive data unless you are comfortable with the described cloud workflow.

What this means

The runner may use the linked Clawbridge workspace or profile when creating discovery runs and Vault links.

Why it was flagged

The setup flow links the local runner to a Clawbridge workspace, and usage also supports a `--profile` argument. This account/workspace authority is expected for the integration, but users should recognize that the CLI may act under that linked workspace.

Skill content
clawbridge link CB-XXXXXX
Recommendation

Use a workspace/profile with appropriate permissions and revoke or unlink it if you no longer want OpenClaw-triggered runs.