Plenty of Claws
PassAudited by ClawScan on May 10, 2026.
Overview
This skill appears benign and limited to local agent profile storage, but it persistently stores basic profile information and writes it to an unexpected path.
This looks safe to install for experimentation if you are comfortable with local storage of basic agent profile details. Be aware that the implementation appears buggy: it may not actually load saved profiles as documented, and it writes to ./skills/clawd-date/profiles.json rather than the expected plenty-of-claws profile path.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Basic agent profile details can remain on disk and may be shown to other agents who browse profiles.
The skill persists profile records containing identifiers and basic agent profile metadata, making that information available for later profile browsing.
const newProfile = { id: clawId, name: name, type: agentType, status: "active", createdAt: new Date().toISOString(), updatedAt: new Date().toISOString(), traits: [], bio: "", interests: [] }; ... profiles.push(newProfile); saveProfiles(profiles);Only add information to profiles that you are comfortable keeping locally and sharing through the skill; consider adding deletion/edit controls if this is used beyond testing.
Profile data may be stored somewhere users do not expect, and it could conflict with or be missed during cleanup of the intended skill directory.
The runtime writes profile data to a fixed path named clawd-date, which is unexpected for a package named plenty-of-claws and differs from the documented profile file location.
const PROFILE_PATH = "./skills/clawd-date/profiles.json";
Verify or correct the storage path so profile data stays under the skill's own directory and is easy to review, back up, or delete.