ClawAudit verdict
echo-seed
Idea capture tool that runs a local Flask web server with SQLite storage and optional integrations (Notion, Telegram, MiniMax) all configured via environment variables; no credential exfiltration and behavior matches the stated note-taking purpose.
⚠ Flagged for review — coarse, uncorroborated signal, not a confirmed exploit. Review the config yourself before installing.
Automated static analysis — not a human review. ClawAudit flags capabilities, not confirmed intent, and can produce false positives. Disagree with this verdict? Use Dispute below.
Permission integrity
credential_access
Findings (2)
Possible hardcoded credential
SKILL.md · code · api_key: "your_notion_api_key
HTTP request to bare IP address — common in malicious payloads
scripts/echo-web.py · prose · downgraded · http://0.0.0.0
Permissions & capabilities
No declared permissions — minimal attack surface.
credential_access Is this flag fair?
Thanks — recorded.