PC*Miler

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill may let the agent make PCMiler API requests under the user's account or key.

Why it was flagged

The skill needs a PCMiler credential to make API calls. This is expected for the stated API purpose, but users should notice that the registry metadata lists no required environment variables or primary credential.

Skill content
compatibility: Requires network access and valid PCMiler API key ... Requires environment variable
- `PCMILER_API_KEY` - PCMiler API Key
Recommendation

Use a dedicated or least-privileged PCMiler API key where possible, keep it out of shared logs, and set the environment variable only in trusted environments.

What this means

Route, coordinate, and address information provided to the skill may be transmitted to PCMiler's external API.

Why it was flagged

The examples send addresses, coordinates, and route stops to the external PCMiler service in API request URLs. This is purpose-aligned, but it is a data flow users should understand.

Skill content
curl -s -X GET "https://pcmiler.alk.com/apis/rest/v1.0/Service.svc/locations?street=1%20Independence%20Way&city=princeton&state=nj...
Recommendation

Only submit location data you are comfortable sharing with PCMiler, and review the provider's privacy, retention, and logging practices if the routes are sensitive.