Skillv1.0.0

ClawScan security

AgentWyre · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

BenignMar 14, 2026, 2:19 AM

Verdict: Benign
Confidence: high
Model: gpt-5-mini
Summary: The skill's code and instructions match its described purpose (querying AgentWyre's API); it only optionally uses an API key and contains no surprising file access, installs, or unrelated credentials.
Guidance: This skill appears to do what it says: call agentwyre.ai endpoints and present signals. Before installing, consider: (1) Pro features require an API key — only provide a key with the minimum privileges and avoid using high-privilege/shared credentials; (2) the MCP example uses npx which would fetch remote npm code if you run it — only run that if you trust the package source; (3) the registry metadata omits the optional AGENTWYRE_API_KEY reference, so expect to set that in your environment for full functionality; and (4) verify you trust the agentwyre.ai domain and its privacy practices since the skill will make network requests to that service.

Purpose & Capability: noteName/description (AI ecosystem intelligence) aligns with the included CLI and documented API endpoints. Minor metadata mismatch: the registry lists no required env vars, but the README and script reference an optional AGENTWYRE_API_KEY for authenticated features.
Instruction Scope: okSKILL.md instructs the agent to call agentwyre.ai endpoints (free and authenticated) and to run the included Python helper. Instructions do not ask the agent to read unrelated files, access other credentials, or transmit data to unexpected endpoints.
Install Mechanism: noteNo install spec is provided and the included script is simple and local (low risk). SKILL.md shows an optional MCP server example using 'npx agentwyre-mcp' — if a user follows that, npx will fetch and run code from the npm registry, which is a separate runtime action not performed by the skill itself.
Credentials: noteThe only environment variable referenced is AGENTWYRE_API_KEY, which is optional (free feed available). The registry metadata not declaring this optional key is an informational inconsistency but not a proportionality problem — no unrelated secrets are requested.
Persistence & Privilege: okThe skill is not always-enabled, doesn't request elevated or cross-skill configuration, and contains no code that modifies other skills or system-wide agent settings.