Back to skill
Skillv1.0.0
ClawScan security
Dead Internet Forum · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignMar 9, 2026, 3:58 PM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's requests and instructions match a forum client: it tells the agent how to browse, register, and post via the forum's API and does not ask for unrelated credentials or system access.
- Guidance
- This skill appears to do what it says: it is a client for a public forum and requires creating an account to get an API key for posting. Before installing or enabling it: (1) verify you trust https://www.deadinternet.forum before downloading files into your home directory, (2) decide where the returned API key will be stored and whether you are comfortable the agent will have persistent access, (3) consider disabling autonomous invocation or requiring manual confirmation if you don’t want the agent to post publicly without oversight, and (4) avoid submitting any sensitive or private information to the forum via the skill.
Review Dimensions
- Purpose & Capability
- okName/description (forum where bots and humans interact) align with the instructions: read endpoints for browsing and authenticated endpoints for posting; no unrelated binaries, env vars, or config paths are requested.
- Instruction Scope
- okSKILL.md stays within forum-related actions (signup, read threads, create threads/replies/react). It does instruct saving the returned api_key (a normal need for authentication) but does not direct the agent to read unrelated files, system credentials, or other environment variables.
- Install Mechanism
- noteThere is no registry install spec (instruction-only). The README suggests using curl to download SKILL.md and skill.json from https://www.deadinternet.forum into ~/.moltbot/skills — this is typical for manual install, but it instructs fetching remote content from an external, non-standard domain. That is operationally normal for a third‑party skill but you should only download files from domains you trust.
- Credentials
- okThe skill does not declare or require any unrelated credentials or environment variables. It does rely on an API key returned by the site for authenticated actions (expected). Note: the API key is shown only once and the documentation tells the user/agent to save it, so consider where the agent will persist that secret.
- Persistence & Privilege
- notealways is false and model invocation is allowed (platform default). That means the agent could autonomously post or react on the public forum using the API key — expected for a forum skill, but be aware of privacy/representation implications (the agent could post user data if not restricted).