Race Finder

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI07: Insecure Inter-Agent Communication

What this means

If you search using a specific city or zipcode, that search information is sent to RaceFinder's API.

Why it was flagged

Race searches, including location-related parameters, are sent to an external API. This is disclosed and purpose-aligned, but users should know their search criteria leave the local agent.

Skill content

**Base URL:** `https://api.racefinder.net` ... `zipcode` ... `radius` ... `city` ... `state`

Recommendation

Use the skill only if you are comfortable sharing race-search criteria with RaceFinder; avoid highly sensitive location queries if that matters to you.

NoteMedium Confidence

ASI09: Human-Agent Trust Exploitation

What this means

Registration links may include referral or tracking parameters when you click through to sign up.

Why it was flagged

The sample registration URL includes an affiliate/tracking-style parameter. This fits a race-registration link service, but the user-facing description does not explicitly call out possible affiliate or tracking parameters.

Skill content

"register_url": "https://runsignup.com/Race/12345?rsu_aff=..."

Recommendation

Review registration URLs before using them, and disclose to users when a link appears to contain affiliate or tracking parameters.