Get company fact and information by ticker or CIK

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only skill appears benign: it documents a limited public-company lookup API, with a disclosed Apipick API key requirement and per-request credit cost.

This skill looks safe for its stated purpose. Before installing, make sure you are comfortable giving your agent access to an Apipick API key and with each lookup consuming API credits.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI03: Identity and Privilege Abuse

What this means

The agent may use or ask for an Apipick API key to make requests on the user's account.

Why it was flagged

The skill uses a third-party API key, but this credential requirement is clearly disclosed and directly necessary for the stated Apipick lookup service.

Skill content

Requires an apipick API key (x-api-key). ... Use `$APIPICK_API_KEY` env var as the `x-api-key` header value; if not set, ask the user for their apipick API key

Recommendation

Prefer setting the key as APIPICK_API_KEY rather than pasting it into chat, and use a limited/revocable key if available.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill can send the requested ticker or CIK to Apipick and consume one API credit per successful request.

Why it was flagged

The skill directs the agent to make external API requests that consume account credits, but the endpoint, parameters, and cost are explicitly documented and limited to company facts lookups.

Skill content

GET https://www.apipick.com/api/company/facts ... Cost: 1 credit per request

Recommendation

Use the skill for intentional company lookups and monitor API credit usage if the agent may invoke it repeatedly.