Idealista Cli
v0.1.0Use the idealista CLI to search Idealista listings by location (city, town, area, street) and fetch listing details. Apply when a user asks for Idealista marketplace data or needs CLI commands/flags for idealista-cli.
⭐ 1· 1.4k·0 current·0 all-time
by@pjtf93
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md describes CLI commands for idealista-cli and lists relevant API-related env vars (API_KEY, OAUTH secrets, device ID, base URL, etc.) — these are appropriate for an Idealista integration. However the registry metadata claims no required binaries or env vars while SKILL.md explicitly says idealista-cli (Node.js 18+) and network access to app.idealista.com are required. That metadata/manifest mismatch is a minor incoherence.
Instruction Scope
The runtime instructions only show CLI commands and JSON output conventions; they do not instruct the agent to read unrelated files, exfiltrate data, or call endpoints outside app.idealista.com. One ambiguity: 'Defaults are prefilled from APK' is vague and should be clarified, but it does not itself expand scope.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing will be written to disk by the skill itself. The SKILL.md expects the user to have installed idealista-cli (Node.js 18+), which is a normal external dependency; no suspicious download URLs or installers are present.
Credentials
SKILL.md lists multiple sensitive environment variables (IDEALISTA_API_KEY, IDEALISTA_SIGNATURE_SECRET, OAUTH consumer key/secret, DEVICE_ID, etc.). While these are plausible for a private API client, the registry metadata declares no required env vars and the skill does not make them mandatory — the discrepancy should be noted. Because these variables are secrets, users should not set them unless they trust the source and understand how the CLI will use them.
Persistence & Privilege
The skill does not request persistent installation, always:true is not set, and it is user-invocable only. It does not attempt to modify other skills or system-wide settings. Default autonomous invocation is allowed (platform default) but not combined with other high-risk privileges.
What to consider before installing
This skill appears to be a documentation/instruction wrapper for an existing idealista CLI — not executable code — but exercise caution before using it: (1) confirm the real idealista-cli package/repository and install it yourself (Node.js 18+); (2) don't set API keys or secrets unless you trust the skill source — the SKILL.md lists sensitive env vars but the registry metadata doesn't declare them as required; (3) clarify what 'APK' means in the configuration defaults; (4) since the skill has no homepage and the source is unknown, prefer a version with a known upstream repository or a published package on npm/GitHub before providing credentials; (5) test commands without credentials (or with limited/test credentials) first and run them in a controlled environment.Like a lobster shell, security has layers — review code before you run it.
latestvk97ff47kbnshk5k5zzrph5h2g17zw8tp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.