Claude Connect
WarnAudited by ClawScan on May 10, 2026.
Overview
Claude Connect is purpose-aligned, but it handles Claude OAuth credentials and installs a persistent background refresher from an unknown and inconsistently documented source, so it should be reviewed carefully before use.
Install only if you specifically want a persistent service to copy and refresh Claude OAuth credentials for Clawdbot. First check whether Clawdbot's native OAuth support is enough, inspect the shell scripts, confirm the LaunchAgent and notification target, and keep a backup of your Clawdbot auth profile.
Findings (5)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Installing this can let Clawdbot use your Claude subscription and may expose or overwrite OAuth credentials if the scripts are wrong or untrusted.
The skill expands the credential boundary by taking Claude OAuth credentials from Keychain and placing access and refresh tokens into Clawdbot's auth profile, giving Clawdbot ongoing delegated Claude access.
Reads OAuth tokens from macOS Keychain ... Writes them to ~/.clawdbot/agents/main/agent/auth-profiles.json ... "access": "sk-ant-...", "refresh": "sk-ant-ort..."
Only install if you trust the source and want Clawdbot to use these Claude credentials; inspect the scripts first, back up auth-profiles.json, and be prepared to revoke or re-authenticate tokens if needed.
The refresher can keep operating in the background and maintaining account access even when you are not actively using the skill.
The skill installs persistent launchd automation that continues to run and handle OAuth tokens after the initial setup task.
Auto-refreshes every 2 hours ... Runs every 2 hours via ~/Library/LaunchAgents/com.clawdbot.claude-oauth-refresher.plist ... auto-refreshes tokens forever
Verify the LaunchAgent contents and unload or uninstall it when you no longer need it; confirm the documented plist name matches what is actually installed.
It is harder to verify who produced the code and exactly what will run during installation before granting it access to OAuth credentials.
The package lacks provenance and a declarative install mechanism, yet its shell scripts are responsible for credential handling and persistence.
Source: unknown; Homepage: none ... No install spec — this is an instruction-only skill ... Code file presence: install.sh, refresh-token.sh, uninstall.sh
Prefer a known upstream source or Clawdbot's native OAuth flow if available; otherwise manually inspect the shell scripts and verify checksums before running them.
Users may install a credential-handling background service that the package itself says is unnecessary and unmaintained.
This conflicts with the active SKILL.md and registry description that recommend installing the skill to keep tokens refreshed 24/7.
DEPRECATED — Clawdbot Handles This Natively ... This skill is no longer needed ... The code is no longer maintained.
Check whether Clawdbot's native OAuth support already solves the problem, and treat the skill as potentially stale unless the maintainer clarifies the status.
Refresh status messages may be sent to an auto-detected chat, user, or phone target that you did not manually confirm.
The installer auto-detects messaging channel targets and uses them for success/failure notifications, which is purpose-aligned but touches private messaging configuration.
Read ~/.clawdbot/clawdbot.json ... telegram: extract default_chat_id or user_id ... slack ... discord ... whatsapp ... imessage ... signal
Review claude-oauth-refresh-config.json after installation, confirm the notification target, and disable notifications if you do not want these messages sent.