The skill for chess player

• Risk level: Low
• Analyzed: May 1, 2026, 6:00 AM
• Findings: 1
• Version: 1.0.0

Overview

This skill appears benign: it fetches public Chess.com statistics for a user-provided username and does not request credentials or modify accounts.

This skill is appropriate if you want public Chess.com stats for a username. It should not ask for passwords, tokens, or private account data.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI02: Tool Misuse and Exploitation

Note

What this means

The Chess.com username you provide will be sent to Chess.com's public API to retrieve public statistics.

Why it was flagged

The script contacts an external API using the supplied Chess.com username. This is purpose-aligned and bounded to a public read-only endpoint.

Skill content

API_URL = "https://api.chess.com/pub/player/{username}/stats"

Recommendation

Use only public Chess.com usernames you intend to look up; no password or token should be provided.