Shipp enables a faster way to create connections to real-time data. It's cost-effective, fast to run, and easy to start.

PassAudited by ClawScan on May 10, 2026.

Overview

This is a purpose-aligned Shipp API integration guide, but users should notice that it requires a provider API key, can create/poll account-scoped connections, and includes an optional external trading-bot example.

Install only if you intend to let your agent call Shipp’s API. Keep the API key out of prompts and source code, prefer header authentication, monitor credit/rate-limit usage, and review any optional external example project separately before running it.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

The agent may use your Shipp account and credits when calling the API.

Why it was flagged

The skill requires a Shipp API key and documents multiple ways to send it, including query parameters that can be easier to expose in logs or shell history.

Skill content
All endpoints require an API key... Query parameter `api_key` | `?api_key=YOUR_API_KEY` ... `Authorization` header (Bearer) | `Authorization: Bearer YOUR_API_KEY`
Recommendation

Use an environment variable or secret manager, prefer header-based authentication over query parameters, and use the least-privileged Shipp key available.

What this means

A user-authorized agent can create Shipp connections and poll for live data, which may have cost or rate-limit effects.

Why it was flagged

The skill permits domain-scoped curl calls and documents an endpoint that creates reusable Shipp connections; this is expected for the stated purpose but is still an account-affecting API action.

Skill content
allowed-tools:
  - Bash(curl:https://api.shipp.ai/*)
  - Bash(jq:*) ... `POST /api/v1/connections/create`
Recommendation

Confirm before creating new long-lived connections, keep polling intervals reasonable, and reuse existing connection IDs where possible.

What this means

If you follow the example, you would run separate third-party code and provide additional API keys; outside paper/demo mode it may involve real-money trading.

Why it was flagged

The README includes optional commands for cloning and running an external example project that is not part of the reviewed skill artifacts.

Skill content
git clone https://gitlab.com/outsharp/shipp/alph-bot.git ... yarn migrate ... ./index.ts value-bet -d --paper --game <GAME_ID>
Recommendation

Treat Alph Bot as separate software: review its source and dependencies, use paper/demo mode first, and do not run real-money actions without explicit approval.