Wallapop Cli
v0.1.0Use the wallapop CLI to search listings, fetch item details, view user profiles, and list categories. Apply when a user asks for Wallapop marketplace data or when you need CLI commands and flags for wallapop-cli usage.
⭐ 1· 1.7k·0 current·0 all-time
by@pjtf93
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name and description describe a CLI helper for Wallapop and the SKILL.md provides precise commands and flags that align with that purpose. However, the metadata claims no required binaries or env vars while the SKILL.md explicitly says it requires wallapop-cli (Node.js 18+) and references env vars (WALLAPOP_LAT, WALLAPOP_LNG, WALLAPOP_ACCESS_TOKEN). The missing declared dependency is an inconsistency.
Instruction Scope
Runtime instructions are narrowly scoped to invoking wallapop-cli commands and handling output/JSON. They reference network access to api.wallapop.com and optional auth token for some endpoints, which is consistent with the stated functionality. The instructions do not direct the agent to read unrelated files or exfiltrate data beyond calls to the Wallapop API.
Install Mechanism
This is an instruction-only skill with no install spec or code files, so nothing will be written or executed by the skill itself. That lowers installation risk. Note: SKILL.md expects the user to install wallapop-cli (Node.js 18+) separately; no install instructions or provenance are provided.
Credentials
The SKILL.md references optional env vars (WALLAPOP_LAT, WALLAPOP_LNG, WALLAPOP_ACCESS_TOKEN) which are reasonable for a CLI that calls the Wallapop API. However, the skill metadata lists no required env vars or primary credential — the omission makes it unclear whether the token is required and how it should be provisioned. The need for an access token is expected for non-search endpoints, but you should verify what scopes that token grants and where it will be stored or used.
Persistence & Privilege
The skill does not request persistent presence (always:false) and does not declare any capability to modify other skills or system-wide configuration. Autonomous invocation is allowed (default) but is not combined with other elevated privileges.
What to consider before installing
This skill appears to be a straightforward CLI usage guide for wallapop-cli, but the SKILL.md and the skill metadata disagree: the instructions require wallapop-cli (Node.js 18+) and mention env vars (including an access token), while the metadata lists no binaries or env requirements. Before installing or running anything: (1) confirm the official source for wallapop-cli (npm or project repo) and install it from a trusted upstream; (2) ask the publisher to update the skill metadata to declare required binaries and env vars; (3) only provide a WALLAPOP_ACCESS_TOKEN if you trust the CLI source—inspect what scopes that token grants and avoid pasting high-privilege tokens into unknown tools; (4) if you plan to run the CLI, prefer using --json and script-safe checks for exit codes; (5) because the skill source/homepage is unknown, exercise caution and review the actual wallapop-cli package code before granting network credentials or tokens.Like a lobster shell, security has layers — review code before you run it.
latestvk9724btjhhzdcb9wyfe0rav13d7zx8wz
License
MIT-0
Free to use, modify, and redistribute. No attribution required.