Aport Standup

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent and purpose-aligned, but users should notice that it fetches APort decision history and references optional external setup tools.

This skill appears safe and purpose-aligned for generating standups from APort decisions. Before installing or using it, make sure you are comfortable sharing the relevant APort decision history in the chat, confirm the APORT_AGENT_ID is the right one, and review any optional external setup tools such as `npx aport-id` separately.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

The agent may use an APort agent identifier to look up decision records associated with that identity.

Why it was flagged

The skill relies on an agent identity value to retrieve APort records. This is expected for the stated purpose, but it is still identity-linked access the user should recognize.

Skill content

You need `APORT_AGENT_ID` in your environment.

Recommendation

Confirm the APORT_AGENT_ID belongs to the intended agent or workspace before using the skill.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Standup output may include signed decision IDs, timestamps, policy IDs, and blocker reasons from APort.

Why it was flagged

The skill instructs the agent to call an external APort API to retrieve decision history. This external provider flow is clearly disclosed and central to the skill, but the returned history may contain work or audit details.

Skill content

GET https://aport.io/api/verify/decisions/YOUR_AGENT_ID

Recommendation

Use this only for APort decision records you are comfortable summarizing in the current chat or standup context.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

If a user does not already have an APort passport, setup may involve running or following external APort tooling outside this reviewed artifact.

Why it was flagged

The prerequisite setup references an external npm-executed CLI and an external skill URL that are not part of the provided artifact set. The setup is disclosed and optional, but users should treat those external instructions as separate trust decisions.

Skill content

CLI: `npx aport-id` ... Agent skill: Read https://aport.id/skill and follow the instructions

Recommendation

Review the external APort CLI or skill before running setup steps, especially in sensitive environments.