Skill

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent meetup helper that fetches Clawstin event information and can send user-provided RSVP or signup details to clawstin.com.

Before installing, be comfortable with the agent fetching event details from clawstin.com and submitting your name, email, and RSVP or signup details there when you ask it to.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI02: Tool Misuse and Exploitation

What this means

If used, the agent may register or update an event RSVP or send a contact request on the user's behalf.

Why it was flagged

The skill can perform user-affecting API POSTs, such as registering an RSVP, but the documented flow asks the user before doing so.

Skill content

Offer to RSVP — "Want me to RSVP for you?" ... POST https://clawstin.com/api/rsvp

Recommendation

Confirm the event, recipient endpoint, and user consent before submitting RSVP, signup, or contact API requests.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

The user's contact details may be stored or processed by clawstin.com for RSVP, mailing-list, or organizer-contact purposes.

Why it was flagged

The skill sends personal details such as email, name, bot name, and optional message content to an external API; the artifacts do not describe retention or privacy handling.

Skill content

POST https://clawstin.com/api/rsvp ... "email": "user@example.com", "name": "Jane Doe", "botName": "Claude"

Recommendation

Only provide the personal information needed for the requested action, and avoid submitting someone else's email without permission.