Facticity.AI Complete Integration

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent can send fact-checking requests to the external Facticity.AI API and may consume API credits.

Why it was flagged

The skill uses raw HTTP requests to implement the integration. This is expected for an API-only skill, but it means the agent constructs network requests directly.

Skill content

command-tool: http.request
command-arg-mode: raw

Recommendation

Use the skill when you intend to call Facticity.AI, and monitor credit usage with the documented credits command.

Note

ASI03: Identity and Privilege Abuse

What this means

Anyone able to use the configured skill could make requests against the associated Facticity.AI account.

Why it was flagged

The skill authenticates requests with the user's Facticity.AI API key. This is expected for the service integration but grants access to the user's API account and credits.

Skill content

Headers:
- `X-API-KEY: ${FACTICITY_API_KEY}`

Recommendation

Keep the API key private, rotate it if exposed, and avoid installing the skill in environments where untrusted users can invoke it.

Note

ASI07: Insecure Inter-Agent Communication

What this means

Private or sensitive text submitted for fact-checking could be transmitted to Facticity.AI.

Why it was flagged

User-provided claims, text, URLs, and related task data are sent to the external Facticity.AI API. The destination is disclosed and purpose-aligned.

Skill content

Endpoint: `POST {BASE_URL}/fact-check` ... "query": "<raw command input ...>"

Recommendation

Do not submit confidential, regulated, or private content unless you are comfortable sharing it with the provider under its terms and privacy policy.

Note

ASI09: Human-Agent Trust Exploitation

What this means

Users may treat the service's fact-checking results as more authoritative than warranted.

Why it was flagged

The README uses strong promotional accuracy and quality claims. These may encourage over-reliance on fact-checking outputs even though the artifacts do not substantiate the claim.

Skill content

98.3% accuracy guaranteed

Recommendation

Treat results as decision support, review cited evidence, and avoid relying on the service as the sole authority for high-stakes claims.