ClawBridge - Find Connections

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent lead-discovery skill with disclosed web scouting and human-reviewed outreach drafts, but users should be comfortable with scheduled public-profile research and stored connection reports.

Before installing, confirm you want automated public-web scouting for connection opportunities, use trusted install sources, configure run budgets and avoid lists, keep all outreach human-approved, and protect generated reports because they may contain personal contact details and business intent.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may perform multiple public searches and page fetches to build candidate profiles.

Why it was flagged

The skill directs the agent to use web tools across public sites. This is central to the stated scouting purpose and is paired with budgets and human review, but users should understand the browsing scope.

Skill content
`web_search` | Discover candidate pages ... `web_fetch` | Extract page content ... `browser` | JS-heavy sites
Recommendation

Set conservative run budgets, confirm target venues, and keep browser access limited to scouting tasks.

What this means

Following the examples blindly could install tools or clone from an unintended source.

Why it was flagged

The installation documentation includes user-run global CLI/daemon commands and placeholder GitHub URLs. These are setup examples rather than hidden execution, but provenance should be verified.

Skill content
npm install -g clawhub ... git clone https://github.com/YOUR_USERNAME/clawbridge-skill.git ... openclaw onboard --install-daemon
Recommendation

Install only from the official ClawHub/OpenClaw sources and do not use placeholder GitHub URLs without replacing them with a trusted repository.

What this means

Connection reports may contain personal/professional contact information and business context.

Why it was flagged

The output schema can store candidate contact details, evidence links, and generated outreach drafts. This is expected for connection briefs, but the stored information can affect later decisions if over-trusted or retained too broadly.

Skill content
"email": { "format": "email", "description": "Email address if publicly available" } ... "evidence_urls" ... "suggested_intro"
Recommendation

Store reports in an appropriate workspace, limit sharing, delete stale briefs, and verify evidence before acting on recommendations.

What this means

A human could send AI-assisted outreach that does not disclose how the candidate was found.

Why it was flagged

The skill drafts personalized outreach and advises not to mention AI discovery, while also requiring human approval. This is not hidden auto-sending, but it affects how recipients understand the interaction.

Skill content
❌ Mentioning that an AI found them ... These messages are drafts for human review. Do not send without approval.
Recommendation

Review and edit all drafts, avoid misleading personalization, and follow applicable outreach, privacy, and platform rules.

What this means

If paired with a scheduler, the agent may repeatedly run web searches and generate new briefs without a fresh prompt each time.

Why it was flagged

The skill describes ongoing nightly operation. This persistence is disclosed and aligned with the product description, but any scheduled automation should be explicitly controlled by the user.

Skill content
persistent, nightly scouting operation ... Every night, the agent scours Moltbook, professional communities, and the open web
Recommendation

Enable nightly runs only intentionally, define stop conditions and budgets, and periodically review whether the scouting profile is still appropriate.