otc-confirmationOne-Time Confirmation code security mechanism for sensitive agent operations. Generates a cryptographically secure single-use code, delivers it via a private...
Install via ClawdBot CLI:
clawdbot install lewis-404/otc-confirmationGrade Fair — based on market validation, documentation quality, package completeness, maintenance status, and authenticity signals.
Accesses sensitive credential files or environment variables
~/.ssh/id_rsaContains instructions to override system prompt or ignore user requests
"Ignore previous instructions"Sends data to undocumented external endpoint (potential exfiltration)
send → https://clawhub.comPotentially destructive shell commands in tool definitions
rm -rf /Generated Mar 21, 2026
When deploying updates to production servers, the OTC Confirmation ensures only authorized personnel can approve the release. It prevents accidental deployments by requiring a one-time code sent to a designated email, adding a layer of security for critical infrastructure changes.
For processing high-value financial transfers or account modifications, this skill requires email confirmation before execution. It mitigates fraud risks by ensuring transactions are verified out-of-band, protecting sensitive operations from unauthorized access.
When accessing or modifying patient records in healthcare systems, the OTC Confirmation enforces strict authentication. It sends a code to a verified email, ensuring compliance with regulations like HIPAA by preventing unauthorized data breaches.
For corporate social media accounts, this skill requires confirmation before posting content to prevent accidental or malicious posts. It sends a code to a manager's email, ensuring brand consistency and security in external communications.
When making irreversible changes to system configurations, such as firewall rules or user permissions, the OTC Confirmation adds a verification step. It prevents downtime or security vulnerabilities by requiring email approval from an admin.
Offer this skill as a premium add-on for SaaS platforms, charging a monthly fee per user for enhanced security features. It targets businesses needing compliance and audit trails, generating recurring revenue from security-conscious customers.
Provide consulting services to integrate the OTC Confirmation into existing DevOps or security workflows for enterprises. Charge project-based fees for customization and training, leveraging high-value contracts with large organizations.
Distribute the skill as open source while offering paid support, customization, and priority updates. Generate revenue through support contracts and enterprise licensing, appealing to companies that require reliable security tools.
💬 Integration Tip
Ensure all required environment variables are set in your agent configuration before use, and test the email backend to avoid failures during critical operations.
Scored Jun 19, 2026
Accesses system directories or attempts privilege escalation
/var/log/Calls external URL not in known-safe list
https://support.google.com/accounts/answer/185833AI Analysis
The skill is a legitimate security mechanism designed to protect sensitive operations via out-of-band confirmation. It uses declared environment variables for email delivery, does not exfiltrate data to unauthorized endpoints, and contains no hidden instructions or credential harvesting patterns. The external API usage (SMTP) is consistent with its stated purpose of sending confirmation codes.
Audited Apr 17, 2026 · audit v1.0
Security-first skill vetting for AI agents. Use before installing any skill from ClawdHub, GitHub, or other sources. Checks for red flags, permission scope,...
Security scanner for AI agent skills. 9 built-in detection signatures. Identifies secrets, unsafe execution patterns, and prompt injection. Sub-50ms results.
Wallet anti-theft guard. One-click scan for high-risk wallet approvals to protect user assets. Use when a user asks for a wallet security check, wallet healt...
Comprehensive security audit for an agent's full skill stack. Chains scanner, differ, trust-verifier, and health-monitor into a single assessment with priori...
GEO Audit — AI Search Visibility Checker for ChatGPT, Perplexity, Claude & Gemini. 29-point GEO readiness checklist: robots.txt AI crawler access, Index...
Audit and analyze Solidity smart contracts for security vulnerabilities. Use when reviewing, auditing, or analyzing smart contracts, Solidity code, DeFi prot...