AI Product Comparison Skill

ReviewAudited by ClawScan on May 10, 2026.

Overview

The skill mostly matches its product-comparison purpose, but its documentation includes an unsafe command that could overwrite system DNS settings.

This skill appears generally aligned with comparing e-commerce products through Zyte. Before installing, set a limited Zyte API key, avoid submitting private or tokenized URLs, and do not allow the agent to run the README's /etc/resolv.conf DNS command without explicit review.

Findings (4)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If run, this command could change or break the machine's DNS configuration and may require administrator privileges to repair.

Why it was flagged

This troubleshooting instruction writes directly to /etc/resolv.conf, a protected system DNS configuration file. That is a broad local-environment mutation unrelated to the core product-comparison workflow.

Skill content
| DNS resolution errors | Run: `echo "nameserver 8.8.8.8" > /etc/resolv.conf` |
Recommendation

Do not let the agent run this automatically. DNS troubleshooting should be handled with explicit user approval and safer, platform-specific steps.

What this means

The skill can spend quota or incur costs on the user's Zyte account when product URLs are fetched.

Why it was flagged

The skill requires a Zyte API key, which is expected for this integration, but users should be aware the registry metadata does not declare required credentials.

Skill content
`api_key` | Yes | Zyte API key (prefer `$ZYTE_API_KEY` from env)
Recommendation

Use a dedicated Zyte API key with appropriate limits, set it securely as an environment variable, and monitor Zyte usage.

What this means

Product URLs, including any query parameters in those URLs, are shared with Zyte for extraction.

Why it was flagged

The script sends user-provided product URLs to the Zyte API. This is disclosed and purpose-aligned, but it means URL data leaves the local environment.

Skill content
urllib.request.Request("https://api.zyte.com/v1/extract", data=payload, headers=headers, method="POST")
Recommendation

Only submit product URLs you are comfortable sharing with Zyte, and avoid URLs containing private cart, order, session, or account tokens.

What this means

Installing directly from an unpinned repository could fetch code different from the version reviewed here.

Why it was flagged

The README provides a GitHub clone-based install path without pinning a commit or release. This is common for manual installation, but it means future remote changes could differ from the reviewed artifacts.

Skill content
git clone https://github.com/apscrapes/zyte-ecommerce-products-compare-skill
Recommendation

Install the reviewed registry version or pin the GitHub repository to a trusted commit or release before installing.