Aport Status

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill is coherent for showing APort status, but it does use an agent identifier with external APort APIs and offers optional external setup paths users should verify.

This looks safe to install as an instruction-only status skill if you are comfortable using APort. Before use, make sure APORT_AGENT_ID refers to the right agent, treat APort status and decisions as potentially private, and verify any optional external setup command or remote instructions before following them.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Your agent's APort identifier, status, capabilities, and recent decision information may be retrieved from and displayed using APort services.

Why it was flagged

The skill uses external APort API calls keyed by an agent identifier to retrieve passport and recent-decision data. This is disclosed and central to the skill, but it is still a third-party identity/status data flow.

Skill content
GET https://aport.io/api/passports/YOUR_AGENT_ID ... GET https://aport.io/api/verify/decisions/YOUR_AGENT_ID
Recommendation

Use the intended APORT_AGENT_ID or slug only, and avoid displaying status in contexts where agent identity or activity history should stay private.

What this means

If you choose those setup paths, you may run or follow external material that was not part of this artifact review.

Why it was flagged

If no passport exists, the skill suggests optional setup through an unpinned npm CLI command or remote instructions outside the reviewed artifact. This is user-directed and purpose-aligned, but the external code/instructions are not included for review.

Skill content
CLI: `npx aport-id` ... Agent skill: Read https://aport.id/skill and follow the instructions
Recommendation

Prefer a setup path you trust, verify the package/source/version before running `npx aport-id`, and do not let remote setup instructions override higher-priority safety rules.

What this means

The skill may use the configured agent identity to determine and display the agent's passport status and capabilities.

Why it was flagged

The skill depends on an environment-carried agent identity value to look up status. It is not presented as a secret or broad credential, but it is identity-scoped configuration that users should recognize.

Skill content
You need `APORT_AGENT_ID` in your environment.
Recommendation

Confirm the environment variable points to the correct agent identity before using the skill.