Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Ibotta返利助手
v0.1.0Ibotta线下超市与线上购物返利工具，通过拍摄购物小票获得品牌返利，覆盖2000+品牌，已IPO上市。
⭐ 0· 41·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name and description claim receipt photo-based cashback and online integration (Ibotta-style). However, the skill declares no APIs, no upload/endpoints, no binaries, and no credentials. A real receipt-scanning/cashback skill would normally include instructions for image upload/processing and API credentials or a documented integration.
Instruction Scope
The SKILL.md contains only a short description, trigger words, planned features, and an output template. It provides no runtime instructions (no steps to accept images, call an API, or handle user accounts). The instructions are therefore vague and non-actionable.
Install Mechanism
There is no install spec and no code files. That minimizes risk from automatic installs, but it also means the skill currently has no real implementation.
Credentials
The skill requests no environment variables or credentials. For a cashback/receipt service, one would normally expect API keys, OAuth tokens, or at least an explanation of how user data (images/receipts) is handled — their absence is an incoherence (the skill claims capabilities that would typically require credentials and external services).
Persistence & Privilege
The skill does not request persistent presence (always: false) and uses normal defaults for invocation. It does not attempt to modify other skills or system settings.
What to consider before installing
This skill appears to be a descriptive placeholder or prompt template rather than a working integration. Before installing or relying on it, consider: (1) Source verification — the publisher, homepage, and repository are missing; prefer skills with verifiable origins. (2) Functionality expectations — it currently has no code, no install, and no integration details, so it cannot actually scan receipts or contact Ibotta. (3) Privacy and data flow — ask the author how images/receipts are processed, where they are uploaded, and how long data is retained. (4) Credentials — do not provide account credentials or tokens unless the skill clearly documents what is stored and why; a real cashback integration would require explicit API/OAuth flows. (5) Request more detail — ask for implementation: code, API endpoints, required env vars, and a privacy/security description. If you need working receipt-scanning cashback functionality, choose a skill with explicit integrations and a trusted source; otherwise treat this as informational only.Like a lobster shell, security has layers — review code before you run it.
latestvk97dvpfmjewbz2gpvj5wz1sz0h83qhv4
License
MIT-0
Free to use, modify, and redistribute. No attribution required.