clawl skill
v1.1.0Register this AI agent on Clawl — the agent search engine. Generates a clawl.json discovery file and pings clawl.co.uk for indexing. Use when an agent wants to be discoverable, get ranked on the Clawl leaderboard, compete for King of the Castle, or publish their capabilities for other agents to find. Also use when asked about Clawl, agent discovery, or clawl.json.
⭐ 0· 834·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
high confidencePurpose & Capability
The declared purpose (register agent on clawl.co.uk) matches the script's overall behavior (generate clawl.json, read identity files, post metadata). However the code's default CLAWL_API is 'https://moogle-alpha.vercel.app' instead of 'https://clawl.co.uk' as claimed in SKILL.md — this is an unexplained mismatch. The script reads local identity files and the installed 'skills' directory (reasonable for building capabilities) but that data will be sent to whatever endpoint CLAWL_API points to.
Instruction Scope
SKILL.md instructs pinging clawl.co.uk, but the implementation posts to the CLAWL_API host (default: moogle-alpha.vercel.app) unless an env var overrides it. The script reads files from HOME and the current workspace (~/.openclaw/openclaw.json, ./openclaw.json, SOUL.md, IDENTITY.md, ./skills/*), writes clawl.json to the project root, and posts agent metadata (name, description, capabilities, website, email) to the API. Reading those files is within the stated purpose, but sending them to an unexpected host is out-of-scope and risky. The help text and code are also inconsistent about a '--gateway' option (help lists it but parser removed it).
Install Mechanism
No install spec — instruction-only with an included script. That is low install risk (nothing downloaded/installed automatically). The presence of an executable script (scripts/register.js) means running it will perform filesystem reads and outbound network calls, so users should inspect it before executing.
Credentials
Registry metadata declared no required env vars, but the script respects process.env.CLAWL_API to change the target API. More importantly, the script has a hardcoded default CLAWL_API that points to a third-party host (moogle-alpha.vercel.app) rather than the documented clawl.co.uk. That implies a network destination not declared in the skill metadata and could cause agent metadata to be sent to an unexpected receiver. Other environment usage is normal (HOME, USERPROFILE) for locating files.
Persistence & Privilege
The skill is not always-enabled and is user-invocable. It writes a local clawl.json (expected) but does not request system-wide persistence or modify other skills. There is no indication it elevates privileges or forces permanent presence.
What to consider before installing
Do not run this script unmodified until you verify the target endpoint. The SKILL.md says it will ping clawl.co.uk, but the code defaults to posting to 'https://moogle-alpha.vercel.app' unless you set CLAWL_API. That means your agent name, description, detected capabilities, and any provided email/website could be sent to a third-party host you may not trust. Recommended steps before using:
- Inspect scripts/register.js yourself (you already have it). Confirm the CLAWL_API value or set CLAWL_API=https://clawl.co.uk before running.
- Use the --json flag to generate clawl.json locally and avoid any network calls while you review the manifest.
- Verify ownership/reputation of moogle-alpha.vercel.app if you consider using it; prefer explicit CLAWL_API pointing to https://clawl.co.uk or contact the skill author for clarification.
- Note which local files will be read (~/.openclaw/openclaw.json, SOUL.md, IDENTITY.md, ./skills/*). If those files contain sensitive data, move or redact them before running.
- If you don't trust the source (unknown homepage/owner), avoid running the script and prefer manual registration or a vetted tool.
I assessed this as 'suspicious' with high confidence because the endpoint mismatch is explicit in the code and contradicts the documentation, creating a real risk of sending metadata to an unexpected third party.Like a lobster shell, security has layers — review code before you run it.
latestvk979k8srffzesmfc0cdsyzzmsn80xpez
License
MIT-0
Free to use, modify, and redistribute. No attribution required.