Age Verification

Verify user age via ID, face estimation, or third-party services to enforce age restrictions and enable parental controls.

Security Scan

The skill claims to perform sensitive age verification (IDs, face estimation, third‑party services) but the instructions omit required credentials, privacy/PII handling, and concrete install metadata—this mismatch is concerning and needs clarification before use.

Purpose & Capability

The SKILL.md describes document scanning, face-based age estimation, and integrations with Yoti/Jumio — features that normally require camera/file access and API credentials. Yet the skill metadata declares no required environment variables, no config paths, and no install spec. That inconsistency suggests either missing declarations or under-specified behavior.

Instruction Scope

Runtime instructions tell the operator to 'npm install @clawhub/age-guard' and list workflows (ID scanning, face estimation, third-party APIs) but give no guidance on where sensitive images/IDs are stored, where data is sent, how to supply API keys, or how to obtain user consent. The SKILL.md also references GEO_BLOCKING.md which is not present. This leaves broad discretion and potential for inadvertent PII exfiltration.

Install Mechanism

There is no formal install spec in the registry entry, but the instructions instruct installing an npm package (@clawhub/age-guard). Installing an external npm package is a moderate-risk action (downloads third-party code). The lack of a pinned source URL or repository and no code review increases risk.

Credentials

The skill lists integrations with Yoti and Jumio (which require API keys) but the manifest declares zero required env vars or primary credential. That mismatch is disproportionate: age verification features typically require one or more secrets/credentials and explicit permissions for camera/file access.

Persistence & Privilege

The skill does not request always:true and declares no config paths or persistent privileges, which is appropriate. However, it implicitly requires access to cameras, uploaded ID images, or other sensitive device capabilities that are not declared or gated in the instructions.

Scan Findings in Context

[no-findings] expected: The regex-based scanner found no code because this is an instruction-only skill (SKILL.md). Absence of findings is expected given no code files, but it provides no assurance about the npm package the instructions recommend installing.

What to consider before installing

Do not install or run this skill blindly. Before using it, ask the publisher for: the source repository or npm package homepage for @clawhub/age-guard; a clear list of required API keys and how they are stored/used; privacy and retention policies for uploaded IDs and face images; whether image processing is local or sent to third-party services; and any compliance details (COPPA, GDPR). If you must evaluate it, inspect the @clawhub/age-guard package source code and its npm metadata, run it in an isolated environment, and never provide production API keys or real PII until you confirm secure handling and a trustworthy maintainer. The missing GEO_BLOCKING.md reference and absent auth declarations are red flags that should be resolved first.

Age Verification Skills

Skills for age verification and age-appropriate content filtering.

Essential Skills

1. Age Guard

Skill ID: age-guard

Purpose: Verify user age and enforce age restrictions

Features:

• Document verification (ID, passport)
• Face-based age estimation
• Third-party verification (Yoti, Jumio)
• Age gate UI components
• Parental consent workflows

Installation:

npm install @clawhub/age-guard

Methods:

1. Self-reported: Honor system (basic)
2. Document verification: ID scanning
3. Face estimation: Computer vision
4. Third-party: Yoti, Jumio APIs
5. Parental PIN: For children

Use Cases:

• COPPA compliance (children < 13)
• Age-restricted content
• Parental control enforcement

---

For geo-blocking, see GEO_BLOCKING.md.