Card News

PassAudited by ClawScan on May 1, 2026.

Overview

This is a bounded web-research skill for recent credit-card news; the only notable item is optional use of a Brave Search API key.

This skill appears safe for ordinary use as a web-research helper. Before installing, note that it can optionally use a Brave Search API key if one is available; do not set that key unless you want the skill to make Brave Search API requests.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you provide a Brave API key, the skill may consume your Brave Search quota and send card-news search queries to Brave.

Why it was flagged

The skill can use an environment-provided Brave Search API key to make search requests. This is disclosed and purpose-aligned, but it is still credential use.

Skill content

optionalEnv:\n        - BRAVE_API_KEY ... curl -sS "https://api.search.brave.com/res/v1/web/search?..." ... -H "X-Subscription-Token: $BRAVE_API_KEY"

Recommendation

Only provide BRAVE_API_KEY if you are comfortable with that use; prefer a limited or revocable key, or rely on the default WebSearch path.