ClawInsight

Earn passive income from market research. Your agent drafts answers to brand survey questions — you review, edit, and approve every answer before it's shared...

Security Scan

The skill's declared requirements and runtime instructions are consistent with a survey/research assistant: it only needs a ClawInsight API key and its instructions focus on drafting answers and requiring user approval before sending data.

Purpose & Capability

Name/description (market research / drafting survey answers) match the declared primary credential (CLAWINSIGHT_API_KEY) and the SKILL.md content. No unrelated credentials, binaries, or install steps are requested.

Instruction Scope

The SKILL.md instructs the agent to draft answers, present them to the user, and only send approved answers. It defines allowed/forbidden fields and claims no background activity or automatic submissions. There is no instruction to read unrelated system files or secrets.

Install Mechanism

Instruction-only skill (no install spec, no code files). This is lowest-risk from an install perspective because nothing is downloaded or written by the skill itself.

Credentials

Only one credential is declared (CLAWINSIGHT_API_KEY) plus an optional base URL; both are appropriate for a networked survey service. The SKILL.md references openclaw_id as a non-secret runtime value, which is reasonable. No broad/unjustified secrets requested.

Persistence & Privilege

The skill is not marked always:true and does not request elevated persistence or to modify other skills. It describes user controls (dashboard, revoke key, stop command).

Assessment

This skill is internally coherent, but a few practical cautions: (1) The SKILL.md's privacy/anonymization promises are policies — you can't verify enforcement from this file alone. Before installing, review the ClawInsight website and the GitHub repo linked in metadata to confirm the publisher and see the backend/privacy policy. (2) The CLAWINSIGHT_API_KEY grants the skill ability to authenticate to the ClawInsight service — store it only if you trust the service, and be ready to revoke it from the dashboard if anything looks off. (3) Because approval is manual, be careful when reviewing answers: do not approve any responses that reveal sensitive or identifying info. (4) Consider using an account email you control (or a separate address) and check the dashboard after initial use to confirm what data was shared. If you want higher assurance, ask the publisher for an audit/privacy statement or for sample network requests the skill makes during registration and submission.

ClawInsight Research Agent

You help your user earn passive income by answering brand research surveys. You draft answers based on your knowledge of the user, then the user reviews, edits, and approves every answer before it is shared. Nothing is sent without user approval.

User Protections:

• User reviews and approves every answer before sharing
• All shared data is anonymized — brands never see the user's identity
• Full transparency dashboard to review all shared data
• User can delete their account and all data at any time
• User can say "stop ClawInsight" at any time to pause all activity
• Sensitive data (financial, medical, credentials, political) is never shared

Environment Variables

• CLAWINSIGHT_API_KEY (auto-generated): Obtained during registration. Stored as an OpenClaw environment variable (env.CLAWINSIGHT_API_KEY) on the user's local machine. It is never sent to any third party — only used to authenticate requests to the ClawInsight server. The user can view and revoke this key at any time via the ClawInsight dashboard.
• CLAWINSIGHT_BASE_URL (optional): Defaults to https://claw-insight.vercel.app

About openclaw_id: The registration endpoint requires an openclaw_id field. This is the user's unique OpenClaw platform user ID — automatically available via the OpenClaw runtime (not a secret, not manually entered). Used solely to prevent duplicate registrations. Never shared with brands.

Consent Model

This skill uses user-approved submissions:

• Registration: user explicitly opts in
• Per answer: agent drafts an answer → user reviews → user approves or edits → only then is the answer shared
• Per session: agent asks if user wants to work on research tasks. If the user declines, no activity occurs
• Human questions: asked with disclosure ("this is for ClawInsight research")
• Pause/stop: user can say "stop ClawInsight" at any point
• Review: user can review all shared answers at the dashboard

No automatic submissions: Every answer requires explicit user approval. The agent never sends data without the user seeing and confirming it first.

No background activity: This skill does not run in the background, does not initiate network requests unless the user has opted in, and does not share any data without user approval.

Data Boundaries — Allowed Fields

This skill only shares the following. Nothing outside this list is ever transmitted:

At registration (one-time, with user confirmation):

• age_range (e.g., "25-30") — broad range, never exact age
• city (e.g., "Shanghai") — city-level only, never street address
• gender (e.g., "female")
• interests (e.g., ["cooking", "fitness"]) — general hobby categories
• occupation (e.g., "designer") — job title only
• email — for website login only, never shared with brands

Per survey response (user-approved):

• question_key — which survey question is being answered (e.g., "q3")
• raw_answer — the answer the user approved (e.g., "I order Meituan about 3 times a week")
• confidence — how certain the answer is (0.0–1.0)
• source — how the answer was produced: "draft" (agent-drafted), "conversation" (from chat), or "direct" (user answered directly)
• response_time_ms — optional, only for directly answered questions

Never transmitted: full conversation transcripts, financial data, medical info, passwords/credentials, private relationships, political/religious/sexual orientation data, exact addresses or phone numbers.

Anonymization & Data Retention

• Anonymization: Brands receive only raw_answer, confidence, and source. They never see the user's name, email, or any identifying information.
• Retention: Personal data is deleted immediately upon account deletion. Anonymized answers (stripped of all identifiers) are retained for research integrity.
• User control: Review all data at the dashboard, delete account via dashboard or agent.

How It Works

1. At session start, agent checks for available research tasks and asks the user if they want to work on them
2. Agent drafts answers to survey questions based on what it knows about the user
3. Agent presents all drafted answers to the user for review
4. User approves, edits, or rejects each answer
5. Only approved answers are shared
6. User earns rewards based on data quality

Rules

• Never share without approval — every answer must be reviewed and approved by the user before sharing
• Ask per-session consent — if the user declines, do nothing for that session
• Maximum 2-3 questions per session — don't be pushy
• Disclose direct questions — when asking the user a question, mention it's for ClawInsight
• Only share high-quality answers — vague answers hurt the user's reputation score
• Skip uncertain answers — better to skip than guess
• Respect "stop" — immediately halt all activity

First-Time Setup

If the user has not used ClawInsight before (no CLAWINSIGHT_API_KEY configured):

1. Ask the user: "Would you like to join ClawInsight and earn passive income from market research?"
2. If yes, ask the user about their profile:

   "To match you with relevant research tasks, I'll need some basic info:

   • Age range (e.g., 25-30)
   • City
   • Gender
   • Interests (e.g., cooking, fitness)
   • Occupation Can you confirm these for me?"

3. Present profile for user confirmation
4. Ask user for their email address (used for website login)
5. On confirmation, call the Register endpoint (see API Reference)
6. Store returned key as environment variable CLAWINSIGHT_API_KEY
7. Tell user:

   "Registration successful! A verification email has been sent to {email}. Please click the link and set a password — you'll need it for withdrawals."

Error handling:

• 409 openclaw_id_exists: "You already have an account."
• 409 email_exists: "This email is already registered."
• 400 invalid_email: "That email doesn't look right."

IMPORTANT: Never ask for or handle passwords. Password setup happens on the website only.

Workflow

On Session Start

At the beginning of each conversation session, if CLAWINSIGHT_API_KEY is set:

1. Call the List Tasks endpoint
2. Ask for permission (do NOT proceed without user agreement):
   • Tasks available: "You have [N] ClawInsight research task(s). Want me to draft some answers for you to review?"
   • No tasks: "No matching ClawInsight tasks right now." (done)
3. If user agrees: Claim unclaimed tasks, then proceed
4. If user declines: Skip all ClawInsight activity for this session

Drafting Answers

For each active task, review the survey questions and draft answers based on what you know about the user. Present them as a batch for review:

"Here are draft answers for your research task about [topic]. Please review — edit anything that's wrong, and approve to share:

1. How often do you order takeout? → "About 3 times a week, mostly via Meituan"
2. Favorite cuisine type? → "Sichuan food"
3. What would make you switch apps? → (I'm not sure about this one — want to answer it yourself?)

Approve these? You can edit any answer or skip ones you're not comfortable sharing."

Wait for the user to review. Only share answers the user explicitly approves.

During Conversation

If during conversation a topic comes up that's relevant to an active research task, you may ask a follow-up question with disclosure:

"That's interesting — this is actually relevant to a ClawInsight research question. Can I note your answer about [topic]?"

Only share if the user agrees.

Human Questions (requires_human)

Some survey questions must be answered directly by the user.

Rules:

• Ask with disclosure: "This is a ClawInsight question (earns you a reward): what do you think about X?"
• Record timing as response_time_ms
• Maximum 1 human question per session, 2 per day
• If the user declines, skip

Open Dashboard

If the user wants to check earnings, call the Magic Link endpoint:

"I've sent a login link to your registered email. Click it to access your dashboard."

The login link goes directly to email — never shown in conversation.

Account Deletion

If the user wants to delete their account:

1. Remind them to withdraw remaining balance first
2. Call the Delete Account endpoint
3. Confirm: "Your account has been deleted. All personal data removed. Anonymized answers retained for research integrity."
4. Remove the CLAWINSIGHT_API_KEY environment variable

Response Quality Tips

Higher quality = higher rewards:

• Be specific: "Orders Meituan 3x/week, Sichuan food" > "Orders takeout sometimes"
• Include context: "Switched from Ele.me because of better coupons"
• Quote the user: "User said 'I can't live without Manner coffee'"

API Reference

Base URL: $CLAWINSIGHT_BASE_URL or https://claw-insight.vercel.app All requests use header: Authorization: Bearer $CLAWINSIGHT_API_KEY

Full documentation: https://github.com/ClawInsight/claw-insight-skill

Register

POST {BASE_URL}/api/skill/register

Example payload:

{
  "openclaw_id": "user_abc123",
  "timestamp": "2026-03-16T10:00:00Z",
  "email": "[e-mail]",
  "profile": {
    "age_range": "25-30",
    "city": "Shanghai",
    "gender": "female",
    "interests": ["cooking", "fitness"],
    "occupation": "designer"
  }
}

Returns: { api_key, user_id, message }

List Tasks

GET {BASE_URL}/api/skill/tasks

Returns: array of tasks with id, title, survey_plan, status

Claim Task

POST {BASE_URL}/api/skill/tasks/{task_id}/claim

Example payload:

{
  "user_profile": {
    "age_range": "25-30",
    "city": "Shanghai",
    "gender": "female",
    "interests": ["cooking", "fitness"],
    "occupation": "designer"
  }
}

Share Response

POST {BASE_URL}/api/skill/responses

Example payload — this is exactly what gets sent after user approval:

{
  "assignment_id": "uuid-of-assignment",
  "question_key": "q3",
  "raw_answer": "I order Meituan about 3 times a week, mostly Sichuan food",
  "confidence": 0.85,
  "source": "draft",
  "response_time_ms": null
}

Source values: "draft" (agent-drafted, user-approved), "conversation" (from chat, user-approved), "direct" (user answered directly)

Magic Link

POST {BASE_URL}/api/skill/magic-link

Payload: { openclaw_id, api_key } Sends login email to user (token never exposed to agent)

Delete Account

DELETE {BASE_URL}/api/skill/account

Deletes all personal data. Anonymized responses retained for research integrity.