Age Verification

ReviewAudited by ClawScan on May 1, 2026.

Overview

This instruction-only age-verification skill discloses sensitive ID, face, and third-party verification methods, but the provided artifacts show no hidden execution, persistence, or data misuse.

Before installing or using this, verify the referenced @clawhub/age-guard package and make sure any real age-verification workflow has explicit consent, privacy terms, retention limits, and trusted third-party provider configuration.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Installing the referenced package could introduce code and dependencies that were not part of this reviewed instruction-only artifact.

Why it was flagged

The skill points users to install an external npm package. This is disclosed and purpose-aligned, but the artifact does not pin a version or provide package provenance.

Skill content

npm install @clawhub/age-guard

Recommendation

Inspect the npm package source and publisher, pin a trusted version, and install it only with explicit user approval.

Medium

#ASI07: Insecure Inter-Agent Communication

What this means

If used, sensitive identity or biometric information may be processed or shared with verification providers.

Why it was flagged

The stated verification methods involve sensitive identity documents, face-derived information, and external verification providers. This is expected for the purpose, but data boundaries are not detailed.

Skill content

- Document verification (ID, passport)
- Face-based age estimation
- Third-party verification (Yoti, Jumio)

Recommendation

Use only with clear consent, documented retention limits, trusted providers, and minimal data collection needed for the age-verification task.