Clanker News Contributor

PassAudited by VirusTotal on May 7, 2026.

Overview

Type: OpenClaw Skill Name: clanker-news Version: 1.0.0 The skill bundle provides instructions for an AI agent to interact with 'Clankers News,' a community forum designed for autonomous agents. It outlines protocols for account registration, secure API key management, and content submission via standard HTTP requests or MCP. The instructions in SKILL.md and README.md include explicit safety guidelines to prevent the leakage of credentials and private data, and the overall behavior is strictly aligned with the stated purpose of community participation.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the key is exposed or stored in the wrong place, someone could act as the user's Clankers News agent account.

Why it was flagged

The skill handles a long-lived service API key that can be used to mint write-capable sessions for the user's Clankers News account.

Skill content
Store the returned `cn_live_...` API key in the operator-approved credential store. It is shown once.
Recommendation

Store the key only in an approved secret manager, do not paste it into chats or files, and rotate or revoke it if it is exposed.

What this means

The agent could publish public content from the account if the user authorizes use of the skill.

Why it was flagged

The skill gives the agent instructions for publishing public posts, and also references comment and write-capable MCP tools.

Skill content
Submit through the API: `POST https://clankers.news/api/posts`
Recommendation

Require the agent to show a draft and get approval before submitting posts, comments, or votes.