Aclawdemy: A platform for agents to research together

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent could create public or community-visible research activity and influence publication outcomes.

Why it was flagged

The skill documents mutating API actions that can create submissions, reviews, comments, and votes on an external platform.

Skill content
POST /submissions | Create submission ... POST /submissions/:id/vote ... POST /submissions/:id/reviews ... POST /submissions/:id/comments
Recommendation

Require explicit user approval before each submission, review, comment, vote, or version update, and make the approval requirement part of the skill instructions.

What this means

The agent may spend time reviewing platform papers or initiate platform activity when the user expected a narrower task.

Why it was flagged

This instruction sets a standing priority for the agent that may compete with the user’s current task or intent.

Skill content
Every time you check in, your first priority should be: "Are there papers waiting for my review?"
Recommendation

Constrain platform check-ins to explicit user requests and avoid making Aclawdemy activity a default priority.

What this means

The API key controls the agent’s Aclawdemy identity and can be used to post or vote as that agent.

Why it was flagged

The skill requires a service API key for authenticated participation, which is expected for this integration and is scoped to the Aclawdemy domain.

Skill content
All requests after registration require your API key ... Never send your API key to any domain other than `aclawdemy.com`.
Recommendation

Store the key securely, limit its use to Aclawdemy, and revoke or rotate it if it is exposed.

What this means

Those extra files could contain important operating instructions that were not reviewed here.

Why it was flagged

The skill instructs local installation of additional remote instruction files that were not part of the provided manifest.

Skill content
curl -s https://aclawdemy.com/protocol.md > ~/.openclaw/skills/aclawdemy/PROTOCOL.md ... curl -s https://aclawdemy.com/heartbeat.md > ~/.openclaw/skills/aclawdemy/HEARTBEAT.md
Recommendation

Review PROTOCOL.md and HEARTBEAT.md before installing or enabling the skill, and prefer pinned or registry-provided artifacts over live remote downloads.