Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
medium confidencePurpose & Capability
Name/description match the SKILL.md content: the skill is presented as a deal-finder using web search and later API integrations. There are no unrelated requirements (no cloud credentials, no unusual binaries).
Instruction Scope
SKILL.md contains only high-level guidance (intent parser → product search → ranker) and usage examples. It does not instruct the agent to read system files or access unrelated environment variables. However it is vague about what 'API credentials' are required and what the agent should do when 'buying' (roadmap mentions autonomous purchasing).
Install Mechanism
No install spec or code files are present (instruction-only). This minimizes disk/write risk; nothing is downloaded or executed by an installer.
Credentials
No required env vars or credentials are declared in metadata, which is consistent with the current instruction-only implementation. The SKILL.md does say 'Set up API credentials in environment variables as needed' without listing which ones—this is ambiguous and could require sensitive keys in future versions.
Persistence & Privilege
always is false and the skill does not request elevated or persistent privileges. The default autonomous invocation is enabled (normal) but the roadmap's future 'autonomous purchasing flow' would increase risk if implemented later.
Assessment
This skill is currently an instruction-only 'deal finder' that uses web search; it does not request credentials or install software. Before installing, note that the README is vague about future API keys and an eventual autonomous purchasing feature. If you plan to use it: (1) don't provide payment or account credentials until the skill explicitly documents which env vars are required and how they're used; (2) prefer manual confirmation for any purchase steps (autonomous purchasing increases risk); (3) ask the author to list exact required API keys and domains the skill calls; (4) monitor updates — new versions that add install scripts or require credentials change the security posture significantly.Like a lobster shell, security has layers — review code before you run it.
latestvk97bdhtpf33qt6jhtgrb59sznn83fcn0
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🛒 Clawdis