Zillow Zestimate

PassAudited by ClawScan on May 12, 2026.

Overview

This is a focused property valuation lookup skill that uses a Zillapi API key and sends the requested address or property ID to Zillapi.

This skill appears safe for its stated purpose. Before installing, understand that it needs your Zillapi API key, requests may consume credits, and any property address or zpid you ask it to value will be sent to Zillapi.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI03: Identity and Privilege Abuse

What this means

Your Zillapi account key will be used to make valuation requests and may consume Zillapi credits.

Why it was flagged

The skill requires a provider API key, which is sensitive account authority, but it is disclosed and directly tied to the stated Zillapi valuation purpose.

Skill content

Set `ZILLAPI_KEY` to your Zillapi API key (format `zk_...`).

Recommendation

Use a dedicated Zillapi key if possible, keep it private, and monitor API usage or billing limits.

Low

#ASI07: Insecure Inter-Agent Communication

What this means

Property addresses or Zillow property IDs you ask about will be shared with Zillapi to retrieve valuation data.

Why it was flagged

The handler sends the user-provided property address or zpid to the disclosed external Zillapi API to perform the lookup.

Skill content

API_BASE = "https://api.zillapi.com/v1" ... _request("/properties/by-address", params={"address": address, "fields": "zpid"})

Recommendation

Only request lookups for addresses you are comfortable sending to Zillapi, and avoid using the skill on incidental or private addresses unless you intend the lookup.