Shop on Bitrefill
v1.2.1Browse and explore Bitrefill (bitrefill.com): discover gift cards, mobile top-ups, and eSIMs; search by brand, category, or country; compare products and den...
⭐ 0· 620·0 current·0 all-time
byMarco Pesani@marcopesani
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The skill's name and description match its runtime instructions: it is a browse-and-guidance tool for Bitrefill and does not attempt purchases or programmatic access. It does not request credentials, binaries, or config paths that would be unrelated to browsing. One minor provenance inconsistency: SKILL.md metadata lists author/homepage as Bitrefill (https://www.bitrefill.com) but the registry metadata shows no homepage and an opaque owner ID; the skill is instruction-only, but the publisher is not verified in the registry data.
Instruction Scope
SKILL.md and the reference files confine the agent to helping users navigate Bitrefill: providing URLs, explaining country/geolock behavior, listing categories, and advising when to redirect to the bitrefill-cli for programmatic or purchase actions. The instructions explicitly forbid scraping (Cloudflare blocks automated access) and do not direct the agent to read local files, environment variables, or transmit data to external endpoints beyond bitrefill.com/help pages.
Install Mechanism
There is no install specification and no code files — the skill is instruction-only. Nothing will be downloaded or written to disk by the skill itself.
Credentials
The skill requires no environment variables, no credentials, and no config paths. That matches its stated browse-only purpose.
Persistence & Privilege
always:false (default) and user-invocable. The skill does not request persistent privileges, does not modify other skills or agent-wide settings, and does not claim the ability to store tokens or run setup scripts.
Assessment
This skill appears coherent and low-risk: it only provides browsing guidance for bitrefill.com and requires no credentials or installs. Before installing, consider: (1) provenance — the registry shows an unverified owner though the SKILL.md claims 'bitrefill' as author; if provenance matters, verify the publisher; (2) do not use this skill to make purchases or supply secrets — the skill explicitly redirects purchase and API workflows to a different bitrefill-cli skill; (3) links the agent provides should be checked to ensure they go to legitimate bitrefill.com pages (watch for phishing); (4) if you need automated search or purchases, use the official bitrefill-cli or Bitrefill API and be prepared to supply appropriate credentials to that separate tool.Like a lobster shell, security has layers — review code before you run it.
latestvk975sp524df5tk3acgntxdy5c182ns8r
License
MIT-0
Free to use, modify, and redistribute. No attribution required.