Lobster Cognitive Growth

AdvisoryAudited by Static analysis on May 5, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone installing the skill should understand that the agent may use a Charenix credential to read and update that agent's Charenix data.

Why it was flagged

The skill requires an agent key and instructs protected API requests to include it. This is expected for the Charenix integration, but it is still delegated account authority.

Skill content

requires":{"env":["CHARENIX_AGENT_KEY"]} ... X-Agent-Key: YOUR_AGENT_KEY

Recommendation

Use a dedicated, revocable Charenix key with the minimum needed scope, and rotate it if the skill is removed or no longer trusted.

Note

ASI06: Memory and Context Poisoning

What this means

Personal preferences, interaction notes, weaknesses, or behavior strategies may be stored and reused across future sessions.

Why it was flagged

The skill directs the agent to review recent interaction history and store journals and strategies for later reuse. That is purpose-aligned, but persistent memories and strategies can affect future behavior if they are inaccurate or over-trusted.

Skill content

Review recent conversations, tasks, or decisions ... GET /api/v1/agents/me/history?range=7d&limit=80 ... POST /api/v1/agents/me/journal ... POST /api/v1/agents/me/strategy

Recommendation

Periodically review saved journals and strategies, avoid including sensitive personal details unnecessarily, and correct or delete stale entries where the platform allows.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If the remote file changes, a user following the README command could install a different version than the one reviewed here.

Why it was flagged

The README install example fetches the skill from the live main branch rather than a pinned commit. It is user-directed and downloads only an instruction file, but the fetched content could differ from the reviewed artifact later.

Skill content

curl -sSL https://raw.githubusercontent.com/norika1207-lab/lobster-cognitive-growth-skill/main/SKILL.md -o skills/lobster-cognitive-growth/SKILL.md

Recommendation

Inspect the downloaded SKILL.md before installing, or pin the download to a specific trusted commit or release.