Fellow Aiden Precision Coffee Maker
ReviewAudited by ClawScan on May 10, 2026.
Overview
This looks like a legitimate coffee-maker integration, but it needs your Fellow login and has mismatches between the docs, dependency installation, and included code that should be reviewed before use.
Before installing, verify the GitHub/PyPI source, understand that it needs your Fellow password, and be aware that the supplied code does not implement several profile and schedule features advertised in the documentation.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone using the skill must trust it with their Fellow account credentials and access to brewer data.
The skill uses the user's Fellow email and password to authenticate and obtain an access token. This is purpose-aligned for a brewer integration, but it gives the skill account-level access.
auth = {"email": self._email, "password": self._password}
response = session.post(login_url, json=auth, headers=HEADERS)Only install from a trusted source, store the credentials securely, and rotate the password if you stop using the skill.
Installing the skill may pull in external code that is not clearly needed by the included implementation.
The dependency is unpinned. SKILL.md also instructs `pip3 install fellow-aiden --quiet`, while the included fellow.py is a direct API client rather than importing that library, making the dependency provenance and necessity unclear.
fellow-aiden>=0.1.0
Pin the package version, document why it is required, or remove the dependency if fellow.py does not use it.
The assistant may try unsupported account/device-changing actions, and users may overtrust the skill's advertised capabilities.
The skill documentation tells the agent and user these mutating commands exist, but the supplied fellow.py only registers info/status, profiles list/get, and schedules list. This overstates what the reviewed code supports.
Create a new profile ... Delete a profile ... Import a profile ... Share a profile ... Create a schedule ... Delete a schedule
Align SKILL.md and README with the actual code, or include the reviewed implementation for all advertised mutating commands.
If these features are implemented later, an accidental schedule or profile change could affect when the brewer runs.
The documented schedule and profile operations would change persistent brewer behavior. The skill requires deletion confirmation, but schedule/profile creation should also be treated as an explicit user-approved action.
Schedules let the Aiden brew automatically on a weekly timer ... Always confirm with the user before deleting profiles or schedules.
Require clear user confirmation before creating, editing, importing, sharing, or deleting profiles and schedules.