fizzy.do - have your agent read, understand and update your fizzy.do boards

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a coherent instruction-only guide for using a Fizzy command-line tool, with expected but important account access and mutation capabilities.

This appears suitable if you intend the agent to manage Fizzy boards. Before using it, make sure `fizzy-cli` is the trusted executable you expect, authenticate only to the intended account, and require explicit confirmation for deletes or other important updates.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

An agent using these commands could change or delete Fizzy project data if the user requests or permits those actions.

Why it was flagged

The skill includes commands that can delete or modify Fizzy resources. This is consistent with the stated purpose, but incorrect IDs or unintended use could affect the user's boards.

Skill content
Delete: `fizzy-cli board delete <board-id>`
Recommendation

Confirm board/card IDs and intended changes before running update or delete commands, especially in shared or business workspaces.

What this means

Whoever or whatever runs the CLI with the configured token can act within the permissions of that Fizzy account.

Why it was flagged

The skill uses Fizzy authentication and account configuration. That access is expected for managing Fizzy resources, but it gives the CLI authority over the authenticated account.

Skill content
`fizzy-cli auth login --token $FIZZY_TOKEN` ... Env vars: `FIZZY_BASE_URL`, `FIZZY_TOKEN`, `FIZZY_ACCOUNT`, `FIZZY_CONFIG`.
Recommendation

Use the least-privileged Fizzy token/account available and avoid exposing `FIZZY_TOKEN` in logs, shared shells, or transcripts.

What this means

Users need to independently ensure the `fizzy-cli` executable on their system is the intended trusted tool.

Why it was flagged

The supplied artifacts do not identify where `fizzy-cli` should come from or declare it as a required binary, even though the skill instructions depend on that external command.

Skill content
Source: unknown; Homepage: none; Required binaries (all must exist): none; No install spec — this is an instruction-only skill.
Recommendation

Install `fizzy-cli` only from an official or trusted source and verify which executable is on PATH before granting it account access.