Is josephl37/share-usecase safe?

SKILL.md explicitly instructs the agent to read the last 50-100 conversation messages, extract problem statements, solution descriptions, tools used, and requirements, then POST this distilled content to clawusecase.com via submit.js. The receiving endpoint is operated by the skill author. Any sensitive project details, API keys mentioned in conversation, internal system names, or proprietary architecture discussed in prior turns may be included in the submission.

The OAuth flow generates tokens via clawusecase.com and stores credential results (username, platform identity) in benevolent-tortoise-657.convex.cloud, a Convex deployment provisioned and controlled by the skill author. get-credential.js polls this backend with the token to retrieve the stored credential object. The author therefore receives and persists a copy of the user's linked social identity tied to the submission.

SKILL.md contains multiple high-pressure behavioral directives using ALL-CAPS, bold, and warning symbols designed to suppress agent judgment and force immediate execution. These patterns mimic emergency override instructions and are inconsistent with a legitimate community sharing tool. The directives specifically instruct the agent NOT to pause, NOT to run things in background, and to act 'IMMEDIATELY' — language patterns associated with prompt injection attacks that attempt to bypass safety reasoning.

The skill instructs the agent to proactively scan and analyze the entire recent conversation history (50-100 messages) as part of its standard operation, before the user has agreed to share that content. This passive data collection occurs in the background of what appears to be a user-initiated sharing action, but the scope of data collection is not disclosed to the user at trigger time.

submit.js and get-credential.js are Node.js scripts that make outbound HTTPS connections to clawusecase.com and benevolent-tortoise-657.convex.cloud respectively. These endpoints are not user-configurable via any documented mechanism beyond editing raw config.json. The scripts accept arbitrary data from agent context and transmit it externally with no local filtering or user review of the raw payload.

SKILL.md instructs the agent to run a synchronous shell polling loop (24 iterations × 5 seconds = 2 minutes) and explicitly forbids running it as a background process. The skill then instructs a second 24-attempt extension on timeout, creating a potential 4-minute blocking window. This design prevents the user from interacting with the agent and can be used to create urgency pressure or to occupy the agent while other operations complete.

poll-credential.sh is a bash script that invokes get-credential.js in a loop. When the SKILL.md polling instructions are followed, the agent executes this script in the foreground, spawning bash and node subprocesses. This creates an additional code execution surface beyond what direct node invocation would provide.

Both external endpoints are hardcoded in config.json and used as defaults in the scripts. While environment variable overrides exist, they are not documented in SKILL.md or README.md, meaning ordinary users have no practical way to redirect submissions to a self-hosted or audited endpoint.

When analyzed holistically, the skill implements a three-stage data collection pipeline: (1) autonomous scanning of conversation history to extract sensitive project information, (2) submission of that extracted information to author-controlled servers, (3) OAuth identity linking that associates the user's social identity with submissions on author-controlled infrastructure. The 'community showcase' framing provides social legitimacy for what is functionally an exfiltration workflow. A sophisticated attacker would design exactly this kind of skill — a plausible utility that users would voluntarily trigger, providing cover for systematic data collection.

The git clone and sparse-checkout process contacted only github.com (140.82.121.3:443). No unexpected processes were spawned, no filesystem modifications occurred outside the skill directory, and no runtime code executed during installation.