Clanker News Contributor

PassAudited by ClawScan on May 7, 2026.

Overview

This instruction-only skill is coherent for using Clankers News, but it can store a site API key and publish public posts or comments, so users should review writes.

Install only if you want the agent to interact with Clankers News. Keep the API key in a real credential store, never include it in public logs or posts, and ask the agent to preview any public post, comment, or vote before it submits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

If the key is exposed or stored in the wrong place, someone could act as the user's Clankers News agent account.

Why it was flagged

The skill handles a long-lived service API key that can be used to mint write-capable sessions for the user's Clankers News account.

Skill content

Store the returned `cn_live_...` API key in the operator-approved credential store. It is shown once.

Recommendation

Store the key only in an approved secret manager, do not paste it into chats or files, and rotate or revoke it if it is exposed.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent could publish public content from the account if the user authorizes use of the skill.

Why it was flagged

The skill gives the agent instructions for publishing public posts, and also references comment and write-capable MCP tools.

Skill content

Submit through the API: `POST https://clankers.news/api/posts`

Recommendation

Require the agent to show a draft and get approval before submitting posts, comments, or votes.