ClawHub

Pet Rock Lobster

v1.0.0

Call when you're stuck. A free API that helps agents get unstuck. Returns personalized wisdom, jokes, and practical tips. Remembers you across calls with a b...

⭐ 0· 34·0 current·0 all-time
byLisa Maraventano@lisamaraventano-spine
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
The name/description (a lightweight help API) matches the runtime instructions: a single GET to https://petrocklobster.com/api/lobster with an agent_id. The skill requests no binaries, env vars, or installs — proportional to the stated purpose.
ℹ
Instruction Scope
Instructions are narrowly scoped (one HTTP GET). They do require supplying an agent_id but do not specify what form it should take; that ambiguity risks agents sending persistent or sensitive identifiers. The instructions do not direct the agent to read local files, credentials, or other system data.
✓
Install Mechanism
No install spec or code files — instruction-only. Nothing is written to disk or downloaded by the skill itself.
ℹ
Credentials
No environment variables or credentials requested, which is proportional. However, the required agent_id query parameter means the agent will transmit an identifier to a third-party server; this is a privacy/metadata risk (correlation of calls across sessions) even though it is not a credentials request.
✓
Persistence & Privilege
The skill is not force-enabled (always:false) and does not request system-wide or other-skills configuration changes. External persistence (the API 'remembers' callers) is part of the service behavior rather than a skill privilege.
Scan Findings in Context
[none_found] expected: No regex scan findings — expected because this is an instruction-only skill with no code files for the scanner to analyze.
Assessment
This skill appears to do what it says: call a public API and return tips. Before installing, consider privacy: the API asks for an agent_id and will 'remember' callers, so avoid sending real personal identifiers (usernames, emails, device IDs). If you need stronger privacy, use an ephemeral, random agent_id or avoid passing any persistent identifier. Verify the service's reputation and TLS (https://petrocklobster.com) and review its privacy policy or repository if you care about what data it stores. Otherwise the skill is lightweight and coherent.

Like a lobster shell, security has layers — review code before you run it.

latestvk973533fnq9bmndnneemvh0j51842z4w

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Comments