Promociones de Viajes Argentina
PassAudited by ClawScan on May 1, 2026.
Overview
This looks like a benign travel-deals lookup skill that calls one disclosed public API, with minor notes about its use of curl/jq and a third-party service.
This skill appears safe for its stated purpose: it fetches public travel-promotion data from a disclosed API and formats it. Before installing, be aware that it depends on a third-party service and may use local curl/jq commands even though those tools are not declared in the registry metadata.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may contact a third-party promotions API and process the response locally, but the artifacts do not show credential use, sensitive local data access, or account changes.
The skill directs the agent to use command-line tools to make a network request and filter JSON locally. The command is read-only, fixed to a disclosed endpoint, and aligned with the travel-promo lookup purpose.
curl -s "https://anduin.ferminrp.com/api/v1/promos" | jq '.'
Use it for travel-promo lookups only, keep requests scoped to the documented endpoint, and review any returned promo links before clicking.
The skill may fail or require local tools that are not obvious from the registry metadata, but no unsafe install or hidden dependency is evidenced.
The registry does not declare required binaries, while SKILL.md's workflow relies on curl and jq. This is a metadata/dependency visibility gap rather than hidden executable code.
Required binaries (all must exist): none ... No install spec — this is an instruction-only skill.
The publisher should declare curl/jq or describe the expected execution tools; users should ensure those tools are available if their agent follows the shell-based workflow.