biodiversity corridor calculator

• Risk level: Low
• Analyzed: May 1, 2026, 5:46 AM
• Findings: 1
• Version: 1.0.0

Overview

This appears to be a straightforward instruction-only biodiversity calculator, but it sends parcel location data to a disclosed third-party API.

This skill is coherent and low-risk for ordinary use. Before installing, confirm you are comfortable sharing the center latitude/longitude and H3 parcel list with the hosted API at nikhilp.online, especially if the land parcels are commercially or ecologically sensitive.

Findings (1)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

ASI07: Insecure Inter-Agent Communication

Note

What this means

Project locations or parcel identifiers may be shared with the hosted service during analysis.

Why it was flagged

The documented workflow sends geographic coordinates and H3 parcel identifiers to a hosted external API. This is necessary for the skill's stated purpose, but it is still an external data-sharing boundary.

Skill content

Endpoint: POST https://www.nikhilp.online/biodiversity-corridor-calculator/api/analyze ... centerLat ... centerLng ... projectHexes

Recommendation

Use the skill only with location data you are comfortable sending to the listed API, and avoid submitting sensitive conservation or commercial parcel data unless you trust the service.