Vestaboard
PassAudited by ClawScan on May 1, 2026.
Overview
The artifacts match a Vestaboard read/write helper, but installing it means giving the agent a token that can change the board’s displayed message.
Install this only if you want the agent to read and update your Vestaboard. Keep the Vestaboard token in environment secrets, do not override the API base except to a trusted Vestaboard endpoint, preview messages when needed, and use write-layout only with trusted layout JSON files.
Findings (4)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A requested write can immediately change what appears on the Vestaboard.
The write functions send POST requests to the configured Vestaboard API, which is expected for this skill but means the tool can change the board's displayed content.
method: 'POST'
Use preview/read before writing when appropriate, and require an explicit user request or confirmation before write/write-layout actions.
If the wrong JSON file path is supplied, its contents could be sent to the Vestaboard API instead of a valid 6x22 layout.
The write-layout command reads a caller-supplied local file and posts the parsed JSON as the layout. This is purpose-aligned for layout files, but it is not path-scoped or shape-validated.
const raw = readFileSync(path, 'utf8'); const layout = JSON.parse(raw);
Use only trusted files such as content/layouts/*.json for write-layout, and consider validating that layouts are 6 rows by 22 numeric character codes before posting.
Anyone who can use the configured token can read or update the associated Vestaboard.
The skill uses Vestaboard credentials from environment variables. This is expected for reading and writing the board, but the registry metadata does not declare a primary credential or required env vars.
`VESTABOARD_TOKEN` (preferred) — used as `X-Vestaboard-Token` ... `VESTABOARD_RW_KEY` (legacy) — used as `X-Vestaboard-Read-Write-Key`
Store the token only in environment/secret management, avoid putting it in prompts or logs, rotate it if exposed, and only set VESTABOARD_API_BASE to trusted Vestaboard endpoints.
Installing the skill may fetch npm dependencies needed by the local CLI.
Setup is a user-directed npm install rather than an automatic install spec. The included package files show a small, purpose-aligned dependency, but users should still install only from the reviewed package.
npm install
Run npm install only from the reviewed skill directory and prefer using the provided package-lock.json.