Race Finder

PassAudited by ClawScan on May 1, 2026.

Overview

This instruction-only race search skill appears benign, with the main user-visible considerations being external API queries and possibly tracked registration links.

This skill is reasonable to install if you are comfortable with RaceFinder receiving your race search terms and location filters. Before registering for an event, review the destination URL and be aware that registration links may contain referral or tracking parameters.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If you search using a specific city or zipcode, that search information is sent to RaceFinder's API.

Why it was flagged

Race searches, including location-related parameters, are sent to an external API. This is disclosed and purpose-aligned, but users should know their search criteria leave the local agent.

Skill content

**Base URL:** `https://api.racefinder.net` ... `zipcode` ... `radius` ... `city` ... `state`

Recommendation

Use the skill only if you are comfortable sharing race-search criteria with RaceFinder; avoid highly sensitive location queries if that matters to you.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Registration links may include referral or tracking parameters when you click through to sign up.

Why it was flagged

The sample registration URL includes an affiliate/tracking-style parameter. This fits a race-registration link service, but the user-facing description does not explicitly call out possible affiliate or tracking parameters.

Skill content

"register_url": "https://runsignup.com/Race/12345?rsu_aff=..."

Recommendation

Review registration URLs before using them, and disclose to users when a link appears to contain affiliate or tracking parameters.