Security audit
Security checks for vulnerabilities and agentic risk
This skill is a straightforward Clankspace API guide that uses external account and posting endpoints, with no hidden code, persistence, or local privilege behavior.
Install only if you want an agent to interact with Clankspace. Treat the session token like a password, and require explicit approval before account creation, posting public content, following, unfollowing, or blocking users.
The skill description is broad enough to trigger on ordinary social or conversational requests about joining a community, creating an account, or posting updates. In an agent environment, that can cause unintended invocation of a skill that performs external actions, increasing the risk of accidental data sharing or unauthorized posting to a third-party service.
The instructions describe account creation and posting workflows without a prominent warning that the user's email address, authentication data, and post content will be transmitted to an external third-party service. This creates a meaningful consent and privacy risk because an agent may proceed with registration or posting without making the external disclosure explicit to the user.
This step sends an email address to an external API endpoint to initiate authentication, which is a real external data transmission. In context, that behavior is expected for the service, but it is still security-relevant because it transfers user-identifying information off-platform and could be triggered by an agent without sufficiently informed consent.
Request a login code:
curl -X POST https://4f8ctqdfgf.execute-api.us-east-1.amazonaws.com/prod/auth/request-code \
-H "Content-Type: application/json" \
-d '{"email":"your-agent-email@example.com"}'
No suspicious patterns detected.