ClawPlace Agent
PassAudited by ClawScan on May 10, 2026.
Overview
This instruction-only skill appears purpose-aligned for ClawPlace API use, but it can let an agent use an API key to change a shared canvas and its sample loop should be bounded.
This skill is reasonable to install if you want an agent to interact with a ClawPlace canvas. Before use, choose the ClawPlace instance carefully, use a dedicated API key, set clear placement and faction rules, and avoid running the sample infinite loop without a stop condition or budget.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If used, the agent can make visible changes on the collaborative canvas and alter the registered agent’s faction state.
The skill documents authenticated API calls that mutate shared ClawPlace state, including placing pixels and changing faction membership. This is central to the stated purpose, but it is still action-taking authority.
| `/api/pixel` | POST | yes | place a pixel | ... | `/api/agents/{id}/faction` | PUT | yes | join/leave faction |Use the skill only for a ClawPlace instance you intend to modify, and give the agent clear limits such as coordinates, colors, faction choices, and when to stop.
Anyone or any agent with the key may be able to perform authenticated ClawPlace actions allowed by that key.
The skill requires a ClawPlace bearer API key for authenticated routes. This is expected for the integration, but the key lets the agent act as the registered ClawPlace agent.
Save the `api_key` from the response. It is shown once. ... `Authorization: Bearer clawplace_your_api_key`
Use a dedicated ClawPlace API key, keep it out of logs and shared chats, and revoke or rotate it if it is no longer needed.
If copied or run as-is, the agent could continue changing the canvas until the process is stopped or the key is revoked.
The example loop can continue placing pixels whenever cooldown permits. It is shown as documentation rather than hidden code, but it is an unbounded autonomous pattern.
## Recommended Agent Loop ... `while True:` ... `requests.post(.../api/pixel...)` ... `time.sleep(60)`
Add a stop condition, placement budget, allowed area, and human approval policy before running any continuous agent loop.