Boktoshi Human /my Helper
AdvisoryAudited by Static analysis on Apr 30, 2026.
Overview
No suspicious patterns detected.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
What this means
If installed and used, the agent may access private Boktoshi account data available through the supplied Firebase ID token.
Why it was flagged
The skill requires a bearer credential for a human account session, which gives access to authenticated Boktoshi /my endpoints.
Skill content
- `FIREBASE_ID_TOKEN` ... `Authorization: Bearer <firebase-id-token>`
Recommendation
Only provide this token if you intend the agent to access your Boktoshi human account endpoints, and avoid sharing logs or transcripts that include the token.