Zillow × Airbnb Matcher
PassAudited by ClawScan on May 10, 2026.
Overview
The visible artifacts match the advertised real-estate search purpose, but installation uses local npm/shell setup and a RapidAPI key despite sparse registry metadata.
This looks reasonable for a Zillow/Airbnb research helper. Before installing, be comfortable with running the npm-based installer, use a limited RapidAPI key, keep the local .env private, and independently verify any investment conclusions before acting on them.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user relying only on registry metadata might miss that setup runs local code, installs npm packages, and uses an API credential.
The registry-level metadata does not fully expose the source provenance, shell install step, or RapidAPI key requirement that the included skill files describe.
Source: unknown; Homepage: none; Install specifications: No install spec — this is an instruction-only skill; Required env vars: none
Review the included SKILL.md, installer, package files, and owner/source before installing; verify the expected version and setup requirements.
Installing the skill can run the included setup script and third-party npm dependency installation.
The installer executes local shell/Node commands and installs npm dependencies. This is normal for this Node-based skill, but it is still code execution on the user's machine.
npm install --silent 2>&1 | tail -5 ... node "$SKILL_DIR/scripts/search.js" --demo
Run the installer only from a trusted copy of the skill, review package.json/package-lock.json, and use demo mode first if unsure.
The key can consume the user's RapidAPI quota and should be treated as a credential.
The skill sends the user-provided RapidAPI key to the declared RapidAPI Airbnb endpoint to fetch listing data, which is expected for the advertised integration.
'X-RapidAPI-Key': RAPIDAPI_KEY, 'X-RapidAPI-Host': 'airbnb13.p.rapidapi.com'
Use a RapidAPI key limited to the needed APIs, keep the .env file private, monitor usage, and rotate the key if it is exposed.