Countries

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

If the user follows the README installation path, the actual command code they run may come from an external source not represented in this review.

Why it was flagged

The README directs users to clone code from an external GitHub repository that is not included in the provided artifact set or pinned to a commit.

Skill content
git clone https://github.com/jeffaf/countries-skill.git ~/clawd/skills/countries
Recommendation

Verify the GitHub repository and preferably pin a trusted commit or include the reviewed CLI files directly in the skill package.

What this means

Country lookup requests may be sent to the public REST Countries API, but no authentication or sensitive local data access is described.

Why it was flagged

The skill expects the agent to use local command-line tools, including curl for network API access. This is disclosed and aligned with the country lookup purpose.

Skill content
requires:
      bins: ["bash", "curl", "jq", "bc"]
Recommendation

Install only if you are comfortable with the agent making public API calls for country information.