OEE Content Humanizer

PassAudited by ClawScan on May 1, 2026.

Overview

The skill’s behavior matches its text-rewriting purpose, but it uses an Anthropic API key and sends submitted text to Anthropic while the registry metadata does not declare that credential.

This looks safe for its stated purpose if you are comfortable using your Anthropic API key and sending the text you provide to Anthropic. The maintainer should update metadata to declare the API key requirement.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Info

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

A user may install expecting no credential setup, then discover the skill needs an Anthropic API key to function.

Why it was flagged

The registry metadata does not advertise the credential requirement that appears in SKILL.md and the code, so the setup contract is incomplete even though the credential use is purpose-aligned.

Skill content

Required env vars: none; Primary credential: none

Recommendation

Declare ANTHROPIC_API_KEY in the skill metadata or install requirements so users understand the external-service dependency before installation.

Low

#ASI03: Identity and Privilege Abuse

What this means

Use of this skill can incur API usage on the Anthropic account tied to the provided key.

Why it was flagged

The script reads an Anthropic API key from the environment and uses it to authenticate requests; this is expected for calling Claude but is still credential-based account access.

Skill content

api_key = os.environ.get("ANTHROPIC_API_KEY") ... "x-api-key": api_key

Recommendation

Use a scoped Anthropic key where possible, monitor usage, and avoid sharing the environment with untrusted processes.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Any text submitted for rewriting is transmitted to an external LLM provider, which may matter for confidential drafts, customer data, or internal documents.

Why it was flagged

The script sends the constructed prompt, including the user-provided text, to Anthropic's external messages API for rewriting.

Skill content

"https://api.anthropic.com/v1/messages"

Recommendation

Do not submit sensitive or regulated content unless that external processing is acceptable under your privacy and data-handling requirements.