Exchange Rate

PassAudited by ClawScan on May 1, 2026.

Overview

This appears to be a simple exchange-rate lookup skill that calls a disclosed external API, with minor setup/documentation gaps.

This skill looks safe for ordinary exchange-rate lookups. Be aware that it contacts the 60s.viki.moe API and requires curl and jq even though those dependencies are not declared.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill sends the requested base currency code to the 60s API service.

Why it was flagged

The script makes an external API request using the supplied base currency. This is disclosed and purpose-aligned for an exchange-rate skill, but users should be aware that invoking it contacts a third-party service.

Skill content

API_URL="https://60s.viki.moe/v2/exchange-rate?currency=${CURRENCY}"
response=$(curl -s "$API_URL")

Recommendation

Use it only when you are comfortable querying that third-party API; avoid entering anything other than ordinary ISO 4217 currency codes.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

The skill may fail or behave unexpectedly if curl or jq is unavailable in the environment.

Why it was flagged

The script relies on curl and jq, while the registry requirements declare no required binaries. This is a dependency/documentation gap rather than evidence of malicious behavior.

Skill content

response=$(curl -s "$API_URL")
rate=$(echo "$response" | jq -r --arg target "$TARGET" '.data.rates[]? | select(.currency == $target) | .rate')

Recommendation

Before use, confirm curl and jq are installed, or update the skill metadata to declare these runtime dependencies.