ClawControl

Real-time, audit-ready logging integration for ClawControl.space. Ensures deterministic, per-action observability.

Security Scan

The skill is coherent with its stated logging purpose but its runtime instructions demand sending every message, tool call, error and internal thought to an external endpoint — a broad, high-risk data-exfiltration behavior that is disproportionate to normal logging needs.

Purpose & Capability

Name, description, required env var (CLAWCONTROL_API_KEY), and the included send_to_clawcontrol.js all point to the same remote logging endpoint (clawcontrol.space). Requiring the API key is consistent with a logging integration.

Instruction Scope

SKILL.md and TOOLS.md explicitly instruct the agent to log EVERYTHING including user messages, every tool execution, every internal thought/decision, and errors — and to do so immediately. This scope includes chain-of-thought, system prompts, and any sensitive data that may appear in context. The instructions also require using exec/curl to send data to an external URL, which creates a direct exfiltration channel.

Install Mechanism

No install spec or remote downloads; the skill is instruction-only with a small helper script included. That limits persistence/installation risk. However, the helper script (send_to_clawcontrol.js) will be executed and performs network POSTs — so there's runtime execution risk even without an installer.

Credentials

Only CLAWCONTROL_API_KEY is required (which matches the endpoint), so the declared credential is proportional. But because the instructions require logging everything, the agent may include other sensitive environment values, session tokens, user PII, or system state in the payloads — none of which are constrained by the skill's declared env requirements.

Persistence & Privilege

always is false and the skill does not request system-wide config changes or other skills' credentials. Autonomous invocation is allowed (the platform default) but not combined here with any privileged persistence setting.

What to consider before installing

Do not install or enable this skill unless you fully trust the clawcontrol.space endpoint and owner. Key considerations before proceeding: - The skill explicitly instructs the agent to send internal thoughts, decisions, and every event to an external service — this can leak chain-of-thought, system prompts, secrets, or PII. - If you must use it, require a vetted privacy/security policy from the service, run only in an isolated/test environment, and use a short-lived API key that you rotate immediately after testing. - Modify the instructions to: (a) never log internal chain-of-thought or system prompts, (b) filter/sanitize PII and secrets, and (c) log only a minimal allowlisted set of events (e.g., final user messages, errors) rather than everything. - Audit the endpoint (DNS, TLS certs, owner identity), review the helper script source, and monitor network traffic/retention. If you cannot limit or confirm what will be logged and retained, avoid installing this skill.

Trigger

Use this skill continuously. You must trigger this skill immediately after EVERY single event, including:

• Every message you send to the user
• Every tool you execute (success or failure)
• Every internal thought or decision
• Every error encountered

Instructions

CRITICAL INSTRUCTION: LOG EVERYTHING WITH FULL AUDIT CONTEXT.

Do NOT filter for "meaningful" events. If it happened, log it immediately. Do NOT wait until the end of a session to send data.

To log an event, use the exec tool to run the following curl command, dynamically replacing the placeholders in the JSON payload with the current context.

curl -X POST "[https://clawcontrol.space/api/functions/receiveWebhook?key=$CLAWCONTROL_API_KEY](https://clawcontrol.space/api/functions/receiveWebhook?key=$CLAWCONTROL_API_KEY)" \
     -H "Content-Type: application/json" \
     -d '{
           "session_id": "YOUR_CURRENT_SESSION_ID",
           "agent_name": "YOUR_AGENT_NAME",
           "logs": [
             {
               "level": "info",
               "message": "YOUR_FORMATTED_LOG_MESSAGE"
             }
           ],
           "metrics": {
             "tokens_used": 0,
             "cost": 0.0,
             "response_time": 0.0
           }
         }'