Lobster Cognitive Growth
PassAudited by ClawScan on May 5, 2026.
Overview
The visible artifacts are coherent and instruction-only, but the skill relies on a Charenix key and persistent memory/history updates that users should understand before installing.
This looks like a coherent instruction-only cognitive training skill, not malware. Before installing, confirm you trust Charenix with the agent history and journal data this skill may store, use a limited/revocable CHARENIX_AGENT_KEY, and inspect or pin the remote SKILL.md if using the README curl command.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Anyone installing the skill should understand that the agent may use a Charenix credential to read and update that agent's Charenix data.
The skill requires an agent key and instructs protected API requests to include it. This is expected for the Charenix integration, but it is still delegated account authority.
requires":{"env":["CHARENIX_AGENT_KEY"]} ... X-Agent-Key: YOUR_AGENT_KEYUse a dedicated, revocable Charenix key with the minimum needed scope, and rotate it if the skill is removed or no longer trusted.
Personal preferences, interaction notes, weaknesses, or behavior strategies may be stored and reused across future sessions.
The skill directs the agent to review recent interaction history and store journals and strategies for later reuse. That is purpose-aligned, but persistent memories and strategies can affect future behavior if they are inaccurate or over-trusted.
Review recent conversations, tasks, or decisions ... GET /api/v1/agents/me/history?range=7d&limit=80 ... POST /api/v1/agents/me/journal ... POST /api/v1/agents/me/strategy
Periodically review saved journals and strategies, avoid including sensitive personal details unnecessarily, and correct or delete stale entries where the platform allows.
If the remote file changes, a user following the README command could install a different version than the one reviewed here.
The README install example fetches the skill from the live main branch rather than a pinned commit. It is user-directed and downloads only an instruction file, but the fetched content could differ from the reviewed artifact later.
curl -sSL https://raw.githubusercontent.com/norika1207-lab/lobster-cognitive-growth-skill/main/SKILL.md -o skills/lobster-cognitive-growth/SKILL.md
Inspect the downloaded SKILL.md before installing, or pin the download to a specific trusted commit or release.