Back to skill
Skillv1.0.3
ClawScan security
Today's Oil Price - 今日油价 · ClawHub's context-aware review of the artifact, metadata, and declared behavior.
Scanner verdict
BenignApr 3, 2026, 9:45 AM
- Verdict
- benign
- Confidence
- high
- Model
- gpt-5-mini
- Summary
- The skill's code, instructions, and requested credential (JISU_API_KEY) are consistent with a simple wrapper around the JisuAPI oil-price endpoints — nothing in the files appears unrelated or exfiltratory.
- Guidance
- This skill appears to be a straightforward wrapper for JisuAPI's oil endpoints. Before installing: (1) confirm you want to share a JISU_API_KEY with the skill (it's required); (2) ensure the runtime has python3 and the 'requests' package (pip install requests) since no install step is provided; (3) verify rate limits and billing on your JisuAPI account; and (4) note the source/homepage are absent — if provenance matters, consider obtaining the code from a known repository or the API provider. Otherwise the code is small, readable, and consistent with its stated purpose.
Review Dimensions
- Purpose & Capability
- okName/description, SKILL.md, and oil.py all target the JisuAPI 'today oil price' endpoints. Requesting JISU_API_KEY and python3 is appropriate for this purpose; there are no unrelated credentials, binaries, or surprising permissions requested.
- Instruction Scope
- okRuntime instructions only direct the agent to set JISU_API_KEY and run the provided Python script to call api.jisuapi.com. The script only reads the declared env var and command-line JSON and issues HTTP GETs to the documented API. It does not read other files, system state, or send data to unexpected endpoints.
- Install Mechanism
- noteThere is no install spec (instruction-only), which minimizes risk. Note: the script depends on the Python 'requests' package but SKILL.md does not mention installing it — you may need to pip install requests in the environment before use.
- Credentials
- okOnly a single API key (JISU_API_KEY) is required and declared as the primary credential, which directly maps to the external service being used. No other secrets, config paths, or unrelated env vars are requested.
- Persistence & Privilege
- okThe skill is not marked 'always:true', does not modify other skills, and does not request permanent system presence. Autonomous invocation (default) is allowed but not accompanied by other high-risk indicators.