ve-exchange-rates
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to fetch public Venezuelan exchange-rate data as described, with minor transparency notes about local dependencies and a hardcoded emergency fallback rate.
This looks safe to install for public exchange-rate lookups. Before relying on results, ensure python3 and bc are available, and treat any “valor de respaldo” output as an estimate rather than a current official rate.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The skill may fail or behave unexpectedly on systems without python3 or bc installed.
The skill metadata declares no required binaries, but the wrapper requires python3, and the Python implementation also invokes bc for arithmetic. This is not suspicious, but the dependency contract is under-declared.
exec python3 "$SCRIPT_DIR/get_rates.py"
Declare python3 and bc as required binaries, or remove the bc dependency and use Python arithmetic throughout.
In an outage, the result may include an arbitrary stale estimate that could be mistaken for a current rate if the warning is overlooked.
If both BCV and exchangerate-api.com fail, the script returns a hardcoded exchange rate. The runtime output warns about the fallback, but SKILL.md only documents BCV and exchangerate-api.com as data sources.
source = "valor de respaldo"
bcv_rate_str = "420"
print("⚠️ Usando valor de respaldo")Document the hardcoded fallback clearly, label it as an estimate in all affected output, or fail closed instead of returning a fixed financial value.