Find stable, reliable, and secure service for your agents

PassAudited by ClawScan on May 1, 2026.

Overview

This is a coherent discovery-only skill that searches OpenSpend for services, with clear limits around login, setup, and payments.

This skill appears safe for discovery use. Before installing, confirm you trust the OpenSpend CLI already present on your system, approve login only if needed, and remember that the returned services are marketplace search results rather than independent security or reliability guarantees.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

The agent may run local OpenSpend commands to check the CLI/session and search for service providers.

Why it was flagged

The skill instructs the agent to run local OpenSpend CLI commands, including a marketplace search. This is central to the stated purpose and bounded to discovery.

Skill content

command -v openspend
openspend version
openspend whoami
...
openspend search "<capability query>" --limit 5 --json

Recommendation

Use this only if you trust the OpenSpend CLI in your environment, and review the resulting provider list before taking any setup or paid action.

Note

ASI03: Identity and Privilege Abuse

What this means

If approved, the agent may authenticate to OpenSpend or use an existing OpenSpend account session for search.

Why it was flagged

The skill can use an existing OpenSpend session or ask the user to approve login. This is expected for an OpenSpend search workflow and is explicitly scoped.

Skill content

Preferred path: run search with existing CLI session only.
Optional credentialed path: OpenSpend user login via `openspend auth login` with explicit user confirmation.

Recommendation

Only approve login if you intend to use your OpenSpend account for this search; do not provide unrelated secrets or payment credentials.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill will only work where the OpenSpend CLI is already available or where another setup flow handles installation.

Why it was flagged

The registry metadata does not declare or install the `openspend` CLI even though the skill instructions rely on it. The artifact mitigates this by telling the agent not to install/update tools and to stop or hand off if the CLI is missing.

Skill content

Required binaries (all must exist): none
...
No install spec — this is an instruction-only skill.

Recommendation

Verify the OpenSpend CLI is already installed from a trusted source before using this skill.