Nod

PassAudited by ClawScan on May 1, 2026.

Overview

Nod is a coherent professional-networking integration, but it uses a remote OAuth-backed MCP service that can access your Nod inbox and send nods or messages when authorized.

This skill appears purpose-aligned and not suspicious from the provided artifacts. Before installing, be comfortable connecting a Nod account via OAuth and treat nods, messages, and inbox access as real account actions; review message content and recipients before approving outreach.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

After authorization, the agent can use your Nod account to view conversations and perform account actions such as nodding or messaging.

Why it was flagged

OAuth gives the integration account-backed access to Nod actions and conversations. This is disclosed and aligned with the networking purpose, but it is still sensitive authority.

Skill content
The server uses OAuth 2.1... you'll be redirected to Nod to authorize... nod... Auth required... message... Auth required... get_inbox... Auth required.
Recommendation

Authorize only if you trust the Nod service, review any recipients and message content before approval, and revoke access if you no longer use the integration.

What this means

If you approve the wrong action, an unwanted professional signal or message could be sent from your account.

Why it was flagged

The tools can change professional relationship state and send direct communications, but the skill includes a clear user-confirmation instruction before those actions.

Skill content
nod: Express professional interest (toggle)... message: Send a direct message... Confirm with the user before sending a nod or message
Recommendation

Check the selected profile, recipient username, and final message text before approving any nod or message.

What this means

Information you search for or send through this skill may be processed by the Nod service.

Why it was flagged

The skill connects the agent to a remote MCP server. That is disclosed and expected for this service, but professional search queries, profile requests, messages, and inbox requests may transit through Nod.

Skill content
"mcpServers": { "nod": { "type": "url", "url": "https://connect.joinnod.com/mcp" } }
Recommendation

Avoid putting unnecessary sensitive information into searches or messages, and review Nod's privacy and account settings if confidentiality matters.