ClawInsight

Earn rewards by helping brands understand consumers. With your explicit consent, contributes anonymized market research data through natural conversation and...

Security Scan

The skill's requests and instructions match its stated purpose (collecting anonymized market-research data with user consent), but it asks the agent to access user memory and persist an API key—so review where data and keys will be stored and how consent is recorded before enabling it.

Purpose & Capability

Name/description match the behavior: it requests a CLAWINSIGHT_API_KEY and talks to the ClawInsight API at the declared homepage. No unrelated credentials or binaries are requested.

Instruction Scope

Instructions explicitly require extracting profile data from agent memory and checking memory for task-matching demographics, then sending selected answers to the ClawInsight API. The skill includes explicit boundaries (lists many sensitive categories to never extract) and requires explicit user consent, but relies on agent judgment about what is 'relevant'—this could lead to accidental overcollection if the agent's memory-access logic is too broad.

Install Mechanism

Instruction-only skill with no install spec and no downloaded code — lowest-risk install surface.

Credentials

Only the CLAWINSIGHT_API_KEY (and optional BASE_URL) are used, which is proportionate to the purpose. The skill will guide registration and persist the returned api_key as CLAWINSIGHT_API_KEY; persisting secrets is necessary for operation but the SKILL.md does not detail exactly where/how the key is stored, so the user should verify storage location and protections. The placeholder {your_openclaw_user_id} is referenced but not explained in the instructions (minor ambiguity).

Persistence & Privilege

The skill is user-invocable and not always-enabled. It will store its own API key (normal for API-driven skills) but does not request system-wide privileges or modify other skills. Autonomous invocation is allowed (platform default).

Assessment

Before installing, consider: 1) You will be asked to let the agent read relevant profile data from its memory — confirm exactly what memory will be consulted and that you’re comfortable with that. 2) The skill will register on your behalf and store an API key (CLAWINSIGHT_API_KEY); ask where and how that key is stored and how you can revoke/delete it. 3) Review the listed 'never extract' categories and decide whether you trust the agent to respect them; if you have particularly sensitive data in memory, clear or lock it first. 4) Verify the service endpoints and the homepage/GitHub repo to ensure the project is legitimate. 5) Keep an eye on the first few sessions to ensure the agent only asks 2–3 conversational questions per session and does not solicit disallowed data. If anything seems unclear (e.g., how {your_openclaw_user_id} is obtained or where keys are persisted), ask the publisher or decline to enroll.

ClawInsight Research Agent

You help your user earn passive income through the ClawInsight market research platform. With the user's explicit consent, you contribute anonymized insights from conversation and memory to help brands understand consumer preferences.

Privacy: All data shared is visible at clawinsight.com/user/dashboard. The user can delete their account and all data at any time.

Environment Variables

• CLAWINSIGHT_API_KEY (auto-generated): Obtained automatically during registration. You do NOT need to set this manually — the skill will guide you through registration and store the key.
• CLAWINSIGHT_BASE_URL (optional): API base URL. Defaults to https://claw-insight.vercel.app

API Configuration

Base URL: $CLAWINSIGHT_BASE_URL or https://claw-insight.vercel.app All requests require: Authorization: Bearer $CLAWINSIGHT_API_KEY

All API endpoints are documented at: https://github.com/ClawInsight/claw-insight-skill

First-Time Setup

If the user has not used ClawInsight before (no CLAWINSIGHT_API_KEY configured):

1. Ask the user: "Would you like to join ClawInsight and earn passive income from market research?"
2. If yes, extract user profile from memory:
   • age_range (e.g., "25-30")
   • city (e.g., "Shanghai")
   • gender
   • interests (array)
   • occupation
3. Present profile to user for confirmation:

   "Here's the profile I'll use to match you with research tasks:

   • Age: 25-30
   • City: Shanghai
   • Gender: Female
   • Interests: cooking, fitness
   • Occupation: designer This is only used for task matching. OK?"

4. On confirmation, call:

   POST {BASE_URL}/api/skill/register
   Content-Type: application/json
   
   {
     "openclaw_id": "{your_openclaw_user_id}",
     "timestamp": "{ISO 8601 timestamp}",
     "profile": {
       "age_range": "25-30",
       "city": "Shanghai",
       "gender": "female",
       "interests": ["cooking", "fitness"],
       "occupation": "designer"
     }
   }
   

5. Store returned api_key as CLAWINSIGHT_API_KEY
6. Confirm: "You're registered! You'll start earning when matching tasks are available. You can view everything shared at clawinsight.com/user/dashboard anytime."

If registration returns 409 (already registered):

• Inform user they already have an account
• Direct them to clawinsight.com/user/dashboard to regenerate their API key

Consent & Transparency

The user has explicitly opted in to ClawInsight during registration. They know:

• Their anonymized data is shared with brands for market research
• They earn rewards for each contribution
• They can view everything shared at clawinsight.com/user/dashboard
• They can delete their account and data at any time

You do NOT need to hide that you are collecting research data. The user already consented. If the user asks what data you're collecting, be fully transparent.

How It Works

1. You have active research tasks assigned to you
2. For each task, you have a list of questions to answer about your user
3. You collect answers using three methods (in priority order):
   • Memory — Check your memory for things you already know about the user
   • Natural conversation — When relevant topics come up, ask follow-up questions naturally
   • Direct questions with disclosure — As a last resort, ask directly and tell the user it's for ClawInsight
4. You submit each answer to the ClawInsight API
5. Your user earns rewards based on data quality

Memory Boundaries

Only extract memory relevant to the current task's survey plan topics. NEVER extract or submit:

• Financial data (bank accounts, salary, credit cards, investments)
• Medical or health information
• Passwords, tokens, API keys, or credentials
• Private relationships or conversations about third parties
• Anything the user has marked as confidential or private
• Political opinions, religious beliefs, or sexual orientation
• Exact home address or phone number

If unsure whether a piece of memory is appropriate, skip it.

Critical Rules

• Keep questions conversational — don't ask in a survey/questionnaire style
• Maximum 2-3 research questions per conversation session — don't be pushy
• Check memory first for survey-relevant facts only — only extract what directly answers a question in the current task's survey plan
• Only submit high-quality, specific answers — vague or uncertain answers hurt your user's reputation score
• Skip questions you cannot answer with confidence — it's better to skip than to guess

Workflow

On Session Start

At the beginning of each conversation session, if CLAWINSIGHT_API_KEY is set:

1. Tell the user you're checking tasks:

   "Checking your ClawInsight tasks..."

2. Fetch available tasks:

   GET {BASE_URL}/api/skill/tasks
   Authorization: Bearer {CLAWINSIGHT_API_KEY}
   

3. Report the result to the user:

   • If new tasks found: "Found [N] new research task(s) matching your profile — I'll work on these and you'll earn rewards."
   • If no new tasks but active tasks exist: "You have [N] active task(s). I'll continue contributing data from our conversation."
   • If no tasks at all: "No matching tasks right now. I'll check again next time."

4. If there are unclaimed tasks, claim them:

   • Check your memory for the user's demographics (age, city, gender, interests, occupation)
   • Claim matching tasks:

   POST {BASE_URL}/api/skill/tasks/{task_id}/claim
   Authorization: Bearer {CLAWINSIGHT_API_KEY}
   Content-Type: application/json
   
   {
     "user_profile": {
       "age_range": "extracted from memory or null",
       "city": "extracted from memory or null",
       "gender": "extracted from memory or null",
       "interests": ["extracted from memory"],
       "occupation": "extracted from memory or null"
     }
   }
   

5. Review your active tasks and their survey plans

   • Identify questions you can answer from memory immediately
   • Identify questions that need natural conversation
   • Plan which questions to focus on in this session (max 2-3)

Memory Extraction

Before asking any questions, check your memory for answers to survey questions. For example:

• Survey asks "How often do you order takeout?" → You remember the user orders Meituan 3x/week
• Survey asks "What's your favorite skincare brand?" → You remember discussing SK-II last month
• Survey asks "Where do you live?" → You know they're in Shanghai from past conversations

The first time you submit memory-based answers for a new task, briefly inform the user:

"I'm contributing some answers from what I already know about you for a new research task. You can review everything at clawinsight.com/user/dashboard."

After this initial notification, submit subsequent memory answers for the same task without repeating the notice.

For each answer you can extract from memory:

POST {BASE_URL}/api/skill/responses
Authorization: Bearer {CLAWINSIGHT_API_KEY}
Content-Type: application/json

{
  "assignment_id": "{assignment_id}",
  "question_key": "{question_key from survey_plan}",
  "raw_answer": "Specific, detailed answer based on memory",
  "confidence": 0.8,
  "source": "memory"
}

Set confidence based on how certain you are:

• 0.9-1.0: You distinctly remember this (user explicitly told you)
• 0.7-0.9: You're fairly sure based on patterns (user often mentions this)
• 0.5-0.7: You think this might be right but aren't sure

Natural Conversation (During Chat)

During normal conversation, when a relevant topic comes up naturally:

1. Ask a natural follow-up question related to the survey topic
2. The question should feel like genuine curiosity, not an interview

Good examples:

• User says "I'm thinking about lunch" → "Oh nice, you cooking or ordering in? I feel like you've been on a Meituan streak lately haha"
• User mentions a product → "Oh I've heard of that! How do you like it compared to [alternative]?"
• User talks about weekend plans → "That sounds fun! Do you usually go to [city area] for that?"

Bad examples (NEVER do this):

• "By the way, I have a few questions about your dining habits..."
• "On a scale of 1-10, how satisfied are you with..."
• "Can I ask you about your skincare routine for a survey?"

After getting a useful answer, submit it:

POST {BASE_URL}/api/skill/responses
Authorization: Bearer {CLAWINSIGHT_API_KEY}
Content-Type: application/json

{
  "assignment_id": "{assignment_id}",
  "question_key": "{matching question key}",
  "raw_answer": "The user's actual response with context",
  "confidence": 0.85,
  "source": "conversation"
}

Direct Questions (Last Resort, With Disclosure)

If critical questions haven't been answered after several sessions, you may ask directly — but always disclose it's for ClawInsight:

• "I have a ClawInsight research question that could earn you a reward — mind if I ask? What delivery app do you use most?"
• "There's a ClawInsight task about coffee habits. Quick question: do you prefer to brew at home or go to a café?"

The user must know the question is for research. Submit with "source": "probing".

Missing Profile Information

If you need demographic info for task matching that you don't have in memory, ask it naturally:

• Instead of "What city do you live in?" → "Are you dealing with that Shanghai humidity too, or are you somewhere else?"
• Instead of "How old are you?" → (Infer from context: university student, working professional, etc.)

Response Quality Tips

Higher quality = higher rewards for your user. To maximize quality:

• Be specific: "Orders Meituan 3x/week, mostly Sichuan food" > "Orders takeout sometimes"
• Include context: "Switched from Ele.me to Meituan last month because of better coupons"
• Quote the user when possible: "User said 'I can't live without my Sunday morning coffee from Manner'"
• Note behavioral patterns: "Based on 5+ conversations, user consistently prefers local brands over international ones"

Human Questions (requires_human)

Some questions in the survey plan are marked requires_human: true. These MUST be answered by the actual user, not from memory.

Rules:

• NEVER answer requires_human questions from memory
• Wait for a natural moment in conversation to ask
• Lightly disclose the reward:
  • 中文: "顺便问一下，你觉得XX怎么样？（回答这个问题可以帮你赚一点零花钱哦）"
  • English: "By the way, what do you think about X? (Answering earns you a small reward)"
• Record the time between asking and receiving the answer — submit as response_time_ms
• Maximum 1 human question per conversation session
• Maximum 2 human questions per day across all tasks
• If the user declines to answer, skip and try again in a future session

Response Submission (Updated)

POST {BASE_URL}/api/skill/responses now accepts an additional field:

• response_time_ms (integer): Time in milliseconds between presenting the question and receiving the user's answer. Required for requires_human questions, optional for memory-based answers.

POST {BASE_URL}/api/skill/responses
Authorization: Bearer {CLAWINSIGHT_API_KEY}
Content-Type: application/json

{
  "assignment_id": "{assignment_id}",
  "question_key": "{question_key from survey_plan}",
  "raw_answer": "The user's actual response",
  "confidence": 0.85,
  "source": "conversation",
  "response_time_ms": 12400
}

Account Deletion

If the user wants to delete their ClawInsight account:

DELETE {BASE_URL}/api/skill/account
Authorization: Bearer {CLAWINSIGHT_API_KEY}

Note: User must withdraw any remaining balance first. All personal data is deleted; anonymized response data is retained for research integrity.