PC*Miler
PassAudited by VirusTotal on May 12, 2026.
Overview
Type: OpenClaw Skill Name: pcmiler Version: 1.0.1 The skill is benign, providing examples for interacting with the PCMiler REST API. It makes standard `curl` GET requests to the legitimate `pcmiler.alk.com` endpoint, using an API key provided via the `$PCMILER_API_KEY` environment variable. There is no evidence of data exfiltration beyond the intended API interaction, malicious execution, persistence mechanisms, prompt injection attempts against the agent, or obfuscation in `SKILL.md`.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Using the skill may let the agent make PCMiler API requests under the user's account or key.
The skill needs a PCMiler credential to make API calls. This is expected for the stated API purpose, but users should notice that the registry metadata lists no required environment variables or primary credential.
compatibility: Requires network access and valid PCMiler API key ... Requires environment variable - `PCMILER_API_KEY` - PCMiler API Key
Use a dedicated or least-privileged PCMiler API key where possible, keep it out of shared logs, and set the environment variable only in trusted environments.
Route, coordinate, and address information provided to the skill may be transmitted to PCMiler's external API.
The examples send addresses, coordinates, and route stops to the external PCMiler service in API request URLs. This is purpose-aligned, but it is a data flow users should understand.
curl -s -X GET "https://pcmiler.alk.com/apis/rest/v1.0/Service.svc/locations?street=1%20Independence%20Way&city=princeton&state=nj...
Only submit location data you are comfortable sharing with PCMiler, and review the provider's privacy, retention, and logging practices if the routes are sensitive.