Zillow Full

PassAudited by ClawScan on May 12, 2026.

Overview

This appears to be a straightforward Zillapi property-data wrapper that uses your Zillapi key, sends property queries to Zillapi, and may consume credits, with no hidden install, persistence, or unrelated access evident.

Install this only if you intend to use Zillapi for property data. Use a dedicated API key, monitor credit usage, avoid unnecessary broad searches, and remember that queried addresses and listing criteria are sent to Zillapi.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Property lookups or broad listing searches may consume the user's Zillapi credits.

Why it was flagged

The tools can spend API credits and return large property records, but the skill discloses this and instructs the agent to use them only for genuine real-estate requests.

Skill content
Each tool call consumes Zillapi credits... When the intent is ambiguous, ask the user to confirm before calling a tool.
Recommendation

Use the skill only for intentional property-data requests, and confirm before broad searches or repeated lookups.

What this means

Calls are made under the user's Zillapi account and may affect that account's usage quota or billing plan.

Why it was flagged

The handler authenticates to Zillapi using the user's API key from the environment, which is expected for this API integration.

Skill content
k = os.environ.get("ZILLAPI_KEY", "").strip() ... "Authorization": "Bearer " + _key()
Recommendation

Use a dedicated Zillapi key with appropriate plan limits and monitor credit usage.

What this means

The third-party provider can see the property addresses, URLs, or search criteria submitted through the skill.

Why it was flagged

User-supplied addresses, Zillow URLs, listing filters, or zpids are sent to the external Zillapi provider to retrieve property data.

Skill content
API_BASE = "https://api.zillapi.com/v1" ... params={"address": address, "status": status, "fields": fields}
Recommendation

Only query addresses or listings you are comfortable sending to Zillapi, and review Zillapi's privacy practices if needed.