Car Buying Assistant
v1.0.0Help Justin research, compare, and decide on new/used cars in Ontario, Canada (and nearby markets) using structured workflows, web research, and local files....
⭐ 0· 55·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (car-buying research for Ontario) match the contents: an instruction-heavy SKILL.md plus a small helper script to normalize listing JSON. No unrelated credentials, binaries, or external services are requested. Minor metadata inconsistencies: the registry summary reports no required config paths while SKILL.md metadata lists a configPaths entry for ~/Documents/CarSearch/, and SKILL.md version (0.1.0) differs from registry version (1.0.0) — likely bookkeeping issues rather than malicious behavior.
Instruction Scope
Runtime instructions are narrowly scoped to web research of public listings, structured data collection, drafting messages, and writing session reports under ~/Documents/CarSearch/. The SKILL.md explicitly forbids automated logins, payments, or sharing sensitive payment/identity info. It instructs the agent to use only public pages or links provided by the user. The only potentially sensitive capability is writing files into the user's Documents folder (explicit and declared).
Install Mechanism
There is no install spec (instruction-only), which is lowest-risk. The included Python script (normalize_listings.py) is small, readable, and only normalizes JSON files and writes output; it does not perform network access or execute arbitrary code. No downloads or external installers are used.
Credentials
The skill requests no environment variables, no credentials, and no config paths in the registry summary. SKILL.md does reference a local path for reports (~/Documents/CarSearch/) which is reasonable and proportionate to its stated purpose. No secrets or unrelated service tokens are requested.
Persistence & Privilege
always is false and the skill does not request elevated or persistent system privileges. It will create and write files in the user's Documents area (declared in SKILL.md). The skill is allowed autonomous invocation by platform default (disable-model-invocation: false), which is normal — if you prefer tighter control, require user confirmation for web actions or disallow autonomous invocation outside explicit requests.
Assessment
This skill appears internally consistent and low-risk for its stated purpose, but before installing: 1) Confirm you are comfortable with the skill creating and writing files under ~/Documents/CarSearch/ (it will create session folders and JSON/markdown files). 2) Do not provide any sensitive personal or payment information when prompted; the skill explicitly forbids entering such data. 3) Note the minor metadata mismatches (SKILL.md version vs registry version and configPaths declaration); treat these as bookkeeping quirks but verify the author if you want stronger provenance. 4) If you are concerned about autonomous web access, disable autonomous invocation or require explicit confirmation before the agent performs web searches or drafts messages to send. 5) Review any URLs or listing JSON you supply before asking the agent to process them (the included script only normalizes JSON and does not fetch remote content).Like a lobster shell, security has layers — review code before you run it.
latestvk97249sebe54qv97ym8e9wj23x83jt28
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🚗 Clawdis
OSmacOS · Linux · Windows