Zillow × Airbnb Matcher

Find properties for sale that are already generating Airbnb income. Cross-references Zillow listings with active Airbnb rentals using geo-matching and calcul...

Security Scan

The skill's files, install steps, and required RapidAPI key are consistent with its stated purpose (cross-referencing Zillow + Airbnb via RapidAPI); nothing in the code suggests hidden exfiltration or unrelated credential access, though the registry metadata and SKILL.md disagree about required env vars and the source is unknown so exercise normal caution.

Purpose & Capability

Name/description (match Zillow and Airbnb listings) align with what the code does: fetches Zillow and Airbnb data via RapidAPI and performs geo- and address-matching. Required binary (node) and the RAPIDAPI_KEY declared in SKILL.md are appropriate for this purpose.

Instruction Scope

Runtime instructions and scripts are scoped to the skill directory: the install script runs npm install, writes/updates a .env in the skill folder, and the JS code loads .env only from that folder. The commands perform network requests only to RapidAPI-hosted Airbnb and Zillow endpoints (airbnb13.p.rapidapi.com and the Zillow RapidAPI provider). The instructions don't ask the agent to read unrelated system files or other credentials.

Install Mechanism

No remote binary download; install runs the included scripts/install.sh which executes npm install (pulls packages from the public npm registry). This is a common and expected pattern but does carry the normal npm risk surface (third-party dependencies in package-lock.json). There are no obscure external download URLs or extract-from-arbitrary-URL steps.

Credentials

The skill requires one API key (RAPIDAPI_KEY) in SKILL.md/.env which is proportionate to the stated functionality. However, registry metadata at the top of the report lists 'Required env vars: none' while SKILL.md and scripts clearly require RAPIDAPI_KEY — this metadata mismatch is an inconsistency to be aware of. No other secrets or unrelated credentials are requested.

Persistence & Privilege

The skill does not request always:true and does not modify system-wide settings; it stores configuration (RAPIDAPI_KEY) in a .env file inside the skill folder (expected). It can be invoked autonomously by the agent (platform default) but that is normal and not excessive here.

Assessment

This skill appears to do what it says: it uses a RapidAPI key to call Airbnb + Zillow endpoints, matches listings, and prints investment metrics. Before installing: 1) Confirm you obtained the skill from a trusted source (the repo/source is marked unknown here). 2) Use demo mode first (no API key) to verify behavior. 3) Create a dedicated RapidAPI key or account you are comfortable using for this skill; do not reuse sensitive credentials. 4) Review package-lock.json and consider running npm install in an isolated environment (container or VM) if you have risk concerns about third-party npm packages. 5) Verify the .env file lives inside the skill folder (not a global/shared .env) and rotate the RapidAPI key if it was shared elsewhere. If you want to be extra cautious, inspect src/zillow.js to confirm the exact RapidAPI host used for Zillow before running live searches.

Zillow × Airbnb Matcher Skill

This skill finds for-sale properties that already have an active Airbnb listing nearby — using GPS-based geo-matching to cross-reference Zillow and Airbnb data.

How to Use (Chat Commands)

Send any of these messages:

Message	What Happens
search airbnb 78704	Search Austin TX zip code
search airbnb Nashville TN	Search by city
check properties 33139	Miami Beach STR check
airbnb demo	Run demo (no API needed)
search airbnb 78704 max 800000	Filter by max price
search airbnb 78704 min 3 beds	Filter by bedrooms

How It Works

1. Zillow search — Finds all for-sale properties in the ZIP code (~2 seconds)
2. Airbnb search — Finds all active Airbnb listings in the same area (~3 seconds)
3. Geo-matching — Matches properties within 100-200 meters using GPS coordinates
4. Investment analysis — Calculates cap rate, cash flow, mortgage, and break-even occupancy

⏱️ Total runtime: ~5-10 seconds per search (RapidAPI is fast)

Important Notes

• Revenue estimates are based on nightly rate × 70% occupancy. For precise data, use AirDNA ($100+/mo)
• Geo-matching means the Airbnb may be a neighbor's property, not the exact same house — always verify
• Free tier gives 100 Airbnb + 600 Zillow searches per month (RapidAPI free plan)
• Cost per search: $0 on free plan

Setup

1. Get free RapidAPI key: https://rapidapi.com → Sign up (free, no credit card)
2. Subscribe to these 2 APIs (both free):
   • Airbnb: https://rapidapi.com/3b-data-3b-data-default/api/airbnb13
   • Zillow: https://rapidapi.com/SwongF/api/us-property-market1
3. Add to your .env: RAPIDAPI_KEY=your_key_here
4. Test: airbnb demo (no API needed)
5. Live test: search airbnb 78704

See GUIDE.md for step-by-step setup instructions.

Investment Metrics

The tool calculates (with 20% down, 7.25% rate, 30yr fixed):

• Cap Rate — annual return on full purchase price
• Cash-on-Cash — return on your actual cash invested
• Monthly Cash Flow — what's left after ALL expenses
• GRM — how many years of revenue to pay back purchase price
• Break-even occupancy — minimum % booked to not lose money

Investment Grades

• 🟢 A (Excellent) — Cap ≥6%, CoC ≥10%, occupancy ≥85%
• 🟡 B (Good) — Solid returns, normal market risk
• 🟠 C (Fair) — Works but thin margins
• 🔴 D (Weak) — Avoid unless value-add opportunity