Security audit
Security checks for vulnerabilities and agentic risk
This skill uses expected Etsy, Google, Slack, and spreadsheet integrations for listing optimization, with no evidence of hidden code, persistence, or destructive behavior.
Install only if you are comfortable giving the agent Etsy and keyword-research access for listing optimization. Configure optional Slack, SEMrush, or Google Sheets only when needed, review outputs before publishing, and avoid exporting unpublished pricing or product strategy to third-party services unless you intend to share it there.
Referenced artifact was not completely inspected
{"openclaw":{"requires":{"env":["ETSY_API_KEY","GOOGLE_TRENDS_API_KEY"],"bins":["curl","jq"]},"os":["macos","linux","win32"],"files":["SKILL.md"],"emoji":"🛍️"}}
The skill advertises competitor analysis, Slack notifications, Google Sheets export, and external API integrations without clearly warning users that listing data and prompts may be transmitted to third-party services. In an agent setting, this can cause unanticipated disclosure of business-sensitive data, competitor research targets, or shop metadata to external systems.
The competitor analysis section explicitly states that the skill scrapes top Etsy search results, but it does not warn the user about live network access, third-party data collection, or possible policy/compliance implications of scraping. In this context, the danger is not code execution but undisclosed external interaction and collection behavior initiated by the agent.
The batch-processing/export section states that results can be sent to Google Sheets, CSV workflows, and Slack notifications without a clear warning that optimized listing data may leave the local environment. This can expose unpublished product copy, pricing strategy, keyword plans, or shop information to external platforms if the user does not realize exports are occurring.
No suspicious patterns detected.