Open Exchange Rate
Analysis
This skill appears to do what it says—fetch exchange rates from a public API—with only minor setup and network-use notes.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
url = f"https://open.er-api.com/v6/latest/{base_currency}"
response = requests.get(url)The script makes an outbound request to the disclosed ExchangeRate-API endpoint using the requested base currency; this is purpose-aligned but means currency queries are sent to a third-party service.
Required binaries (all must exist): none ... Install specifications No install spec — this is an instruction-only skill.
The metadata does not declare a runtime or dependency setup, while SKILL.md usage runs python3 scripts and the code imports requests; this is a minor setup/dependency declaration gap rather than evidence of unsafe behavior.