Price Watcher
v1.0.0Monitor product URLs to track and alert on significant price changes using a local watchlist without requiring API keys.
⭐ 0· 50·0 current·0 all-time
byNew Age Investments@newageinvestments25-byte
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
The name/description match what the code does: add_product.py auto-fetches a page and saves baseline price, check_prices.py fetches tracked URLs and updates watchlist.json, compare.py filters by percent change, and format_alert.py renders markdown. No unrelated credentials, binaries, or config paths are requested.
Instruction Scope
Runtime instructions and scripts stay within the stated purpose: they fetch product URLs (HTTP GET), parse HTML/JSON-LD/meta tags for prices, update a local watchlist.json, and output results. The scripts only read/write the watchlist in the skill directory and print JSON/markdown; they do not read other system files or send data to external services by default. Note: cron examples in the setup guide show how a user could optionally post results to an external webhook (user-supplied), but the skill itself does not perform that posting.
Install Mechanism
There is no install spec and no remote downloads — this is an instruction+script bundle included in the skill. That is the lowest install risk since nothing arbitrary is fetched at install time.
Credentials
The skill declares no required environment variables or credentials. The setup guide includes an optional example using a DISCORD_WEBHOOK environment variable for user-provided posting, but that is not required and is not used by the scripts themselves.
Persistence & Privilege
always is false and the skill does not request persistent platform privileges. It writes only its own watchlist.json in its skill directory and does not modify other skills or global agent settings.
Assessment
This skill appears to be what it claims: local price checks that fetch product pages and store a watchlist in ~/.openclaw/workspace/skills/price-watcher/watchlist.json. Before installing or running it, consider: (1) The scripts perform outbound HTTP requests to whatever URLs you add — if you add internal network addresses you could inadvertently cause requests to internal services (SSRF-like risk) — only add URLs you trust. (2) The tool writes the watchlist locally; protect that file if it contains sensitive notes. (3) The setup guide shows an optional cron example that posts results to a Discord webhook — the skill does not send data externally by default, but if you configure a webhook or other delivery, you must supply and trust that endpoint. (4) Web scraping can hit anti-bot blocks or violate site terms; use manual price entry where appropriate. (5) If you will allow autonomous agent invocation, be aware the agent could run these scripts and make network requests on its own; restrict or sandbox the skill if you have strict network or data policies. There is no sign of obfuscated code or hidden exfiltration in the provided files.Like a lobster shell, security has layers — review code before you run it.
latestvk97db6tk019ngq0zm79bqmwnxs83xrwf
License
MIT-0
Free to use, modify, and redistribute. No attribution required.