abe-exchange-rates
PassAudited by ClawScan on May 10, 2026.
Overview
The skill appears to do what it says—fetch exchange rates—but it uses a SkillBoss/HeyBoss API key and external rate services, which users should be aware of.
Before installing, confirm you are comfortable providing a SKILLBOSS_API_KEY to the SkillBoss/HeyBoss API flow. The reviewed code appears limited to currency lookups and has no persistence or file access, but the registry metadata should ideally declare the required environment variable.
Findings (1)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the XE scraping path may require a SkillBoss API key, and that key is transmitted to api.heybossai.com for the requested rate lookup.
The script reads an environment API key and sends it as a bearer token to the SkillBoss/HeyBoss API used for XE scraping.
const SKILLBOSS_API_KEY = process.env.SKILLBOSS_API_KEY; ... 'Authorization': `Bearer ${SKILLBOSS_API_KEY}`Use a scoped and rotatable API key if possible, and ensure the skill configuration clearly declares SKILLBOSS_API_KEY before enabling it.