v1.0.0

Flomo Send

BenignClawScan verdict for this skill. Analyzed May 1, 2026, 5:29 AM.

Analysis

This skill appears intended to send user-provided notes to Flomo, but users should notice that it uses and stores a Flomo webhook token and the docs/code are inconsistent about URL-scheme versus webhook-only delivery.

GuidanceBefore installing, confirm you are comfortable giving the skill a Flomo webhook token and having note content posted to Flomo through that webhook. Prefer the local .env configuration, keep the token private, and be aware that the current script is webhook-only despite some URL-scheme wording in the documentation.

Findings (5)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Abnormal behavior control

Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.

Tool Misuse and Exploitation

SeverityLowConfidenceHighStatusNote

scripts/flomo_send.sh

RESP=$(curl -sS -w "\n%{http_code}" -X POST "$WEBHOOK_URL" -H "Content-Type: application/json" -d "$PAYLOAD" || true)

Invoking the helper posts the assembled note content to the configured Flomo webhook. That is the stated function, but it is still a remote account mutation.

User impactAnything sent through the skill becomes a note in the configured Flomo account.

RecommendationUse it only when the user clearly asks to save that content, and review sensitive clipboard or stdin content before sending.

Unexpected Code Execution

SeverityLowConfidenceHighStatusNote

scripts/flomo_send.sh

if [ -f "$ENV_FILE" ]; then
    set -o allexport
    source "$ENV_FILE"
    set +o allexport
fi

The script sources the local .env file as shell code. This is a common configuration shortcut, but a tampered or malformed .env could execute shell syntax when the script runs.

User impactIf the local .env file is edited to include shell commands, those commands could run when sending a note.

RecommendationKeep the .env file private, do not add arbitrary lines to it, and consider changing the script to parse only expected key/value variables instead of sourcing the file.

Human-Agent Trust Exploitation

SeverityLowConfidenceHighStatusNote

scripts/flomo_send.sh

# Main: webhook-only delivery

The actual send script is webhook-only, while SKILL.md describes URL Scheme as the primary path with webhook fallback. This looks like stale or inconsistent documentation rather than hidden behavior.

User impactA user may expect local URL-scheme behavior, but the included script requires and uses the webhook path.

RecommendationUpdate SKILL.md and registry text to match the implemented webhook-only behavior, or implement the documented URL-scheme path.

Agentic Supply Chain Vulnerabilities

SeverityLowConfidenceHighStatusNote

metadata

Required binaries (all must exist): none ... Env var declarations: none ... Primary credential: none

The registry contract does not declare the curl/Python helper expectations or the Flomo webhook credential, even though the included docs and scripts disclose them.

User impactThe platform may not pre-check required tooling or warn about the webhook credential before installation.

RecommendationDeclare curl/Python usage and the optional FLOMO_WEBHOOK_TOKEN or FLOMO_WEBHOOK_URL credential in metadata.

Permission boundary

Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.

Identity and Privilege Abuse

SeverityMediumConfidenceHighStatusNote

scripts/configure.sh

read -rp "Webhook token (or full URL): " WEBHOOK_INPUT ... echo "FLOMO_WEBHOOK_TOKEN=$WEBHOOK_TOKEN" >> "$ENV_FILE"

The setup flow collects and stores a Flomo webhook token, which is expected for this integration but is still delegated account authority.

User impactSomeone who obtains the webhook token may be able to add notes to the user's Flomo account.

RecommendationPrefer the local .env option with restricted permissions, avoid storing the token in shared shell profiles, and revoke/regenerate the webhook if it is exposed.