Skillv1.0.1

ClawScan security

price-tracker · ClawHub's context-aware review of the artifact, metadata, and declared behavior.

Scanner verdict

SuspiciousApr 20, 2026, 9:56 AM

Verdict: suspicious
Confidence: medium
Model: gpt-5-mini
Summary: The skill's code and README largely match its stated purpose, but there are multiple coherence and hygiene issues (missing dependency declarations, registry metadata mismatch about required env vars, and import-time access to a secret) that warrant caution before installing and running it.
Guidance: Before installing or running this skill: (1) Verify the provenance and trustworthiness of the external service 'SkillBoss' — this skill will send your product queries and extracted search results to https://api.skillbossai.com/v1/pilot. Treat the SKILLBOSS_API_KEY like a secret and only provide it if you trust that service. (2) Be aware the registry metadata is inconsistent: SKILL.md and the code require SKILLBOSS_API_KEY but the registry listed no env vars. (3) The code imports 'requests' but the package is not declared; ensure you install dependencies (pip install requests) or run in a controlled environment. (4) The code reads SKILLBOSS_API_KEY at import time which will crash if unset and could leak information in tracebacks — consider setting the variable before importing or changing the code to read it lazily. (5) If you want to reduce risk, run the scripts in an isolated environment (container or VM), use a limited or test API key, and review or instrument network calls to confirm behavior. If you need higher assurance, request the publisher to fix the manifest (declare env var and dependencies) and provide a clear homepage or source repository for auditing.

Review Dimensions

Purpose & Capability: noteThe skill's name/description (price tracking and arbitrage across Amazon, eBay, Walmart, Best Buy) matches the included scripts and the single external service it uses (SkillBoss API Hub). However, registry metadata reported 'Required env vars: none' while SKILL.md and the code require SKILLBOSS_API_KEY — an inconsistency between manifest and runtime requirements. Also the repository uses the 'requests' library but no dependencies are declared.
Instruction Scope: okSKILL.md and the scripts confine actions to searching product listings, extracting prices via the SkillBoss /v1/pilot API, computing margins, reading CSVs, and writing reports/alerts. The only external network calls go to api.skillbossai.com (the unified 'pilot' endpoint). There are no instructions to read unrelated system files or access other credentials. Note: prompts sent to SkillBoss include search results and user keywords, which is expected but means those inputs are transmitted to the external API.
Install Mechanism: concernThere is no install spec (instruction-only install), but the code imports the 'requests' library and expects it to be present; dependencies are not declared. That will cause runtime failures if the environment lacks requests. No archives or downloaded code are used (lower install risk), but missing dependency metadata is a deployment/integrity problem.
Credentials: concernThe only secret required at runtime is SKILLBOSS_API_KEY, which is proportionate to calling a third-party API. However: (1) registry metadata incorrectly reports zero required env vars while SKILL.md and the code require SKILLBOSS_API_KEY, and (2) the code reads SKILLBOSS_API_KEY at module import time (os.environ["SKILLBOSS_API_KEY"]) — this will raise an exception if it's unset and may expose the key in tracebacks. Both are coherence/usability and safety concerns that should be fixed or clarified.
Persistence & Privilege: okThe skill does not request always:true, does not modify other skills, and does not persist or change system-wide agent settings. It performs network calls only to the declared SkillBoss API and writes only user-specified output files; no elevated persistence or privileges are requested.