Willhaben
v1.0.1Create and manage listings on Willhaben.at (Austrian marketplace). Use when the user wants to sell something, create a listing, or mentions Willhaben. Handles photo uploads, generates titles/descriptions/prices, and posts via browser automation.
⭐ 1· 1.8k·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
The skill's name/description match the instructions: it automates creating Willhaben listings, performs market research, drafts text, and posts via browser automation. However, it implicitly requires a 'clawd' browser profile with a saved Willhaben login (i.e., account cookies/credentials) and local image file access — this credential-like requirement is not declared in the skill metadata.
Instruction Scope
SKILL.md stays within the listing/posting scope: it reads a local user-preferences.json in the skill folder, analyzes user-supplied photos, searches willhaben.at, generates title/description/price, and automates form entry and uploads. It does not instruct reading unrelated system files, arbitrary env vars, or sending data to unexpected external endpoints.
Install Mechanism
There is no install spec (instruction-only). No packages or remote downloads are required, which minimizes installation risk.
Credentials
No environment variables or explicit credentials are requested, but the runtime instructions require: (1) access to a clawd browser profile that contains a logged-in Willhaben session (effectively account credentials/cookies), and (2) access to local image file paths for uploads. Both are sensitive capabilities that should be acknowledged by the user even though they aren't declared as required env/config in metadata.
Persistence & Privilege
The skill does not request always:true, does not modify other skills, and only reads/writes its own config (user-preferences.json). Normal autonomous invocation is allowed (platform default).
Scan Findings in Context
[no_regex_findings] expected: Scanner found no regex matches because this is an instruction-only skill with no code files to analyze. That absence is expected but not evidence of safety — the SKILL.md is the primary surface to review.
Assessment
This skill appears to do what it says — post listings to Willhaben using browser automation — but before installing or enabling it, understand the practical implications: it expects a 'clawd' browser profile with your Willhaben login (cookies/session) and will need access to photos (local file paths) to upload. That means the skill will act using your account and uploaded images. If you plan to use it, consider: (1) create or use a dedicated Willhaben account if you don't want automation actions on your primary account; (2) review and edit config/user-preferences.json so defaults are safe; (3) only supply images you intend to publish and confirm every draft before posting; (4) enable or verify 2FA and check whether automation can handle it; (5) do not assume the skill will hide paid-upsell selections — the instructions say to skip them but you should verify before final publish. If you need the skill to avoid using your main account, ask the author to explicitly declare the login requirement in metadata and to document how credentials/profiles are used.Like a lobster shell, security has layers — review code before you run it.
latestvk97ay572643jdfthf8vx9wkzes803e1y
License
MIT-0
Free to use, modify, and redistribute. No attribution required.