Wallapop Cli
PassAudited by ClawScan on May 1, 2026.
Overview
This is a benign instruction-only Wallapop CLI reference, with user-noticeable reliance on a separately installed CLI and an optional access token.
Before using this skill, make sure the separate wallapop-cli you have installed is trustworthy. Only provide WALLAPOP_ACCESS_TOKEN if a command truly needs it, and remember that location variables and marketplace queries may be sent to Wallapop's API.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
If the separately installed CLI is from an untrusted or unexpected source, commands could behave differently than the skill documentation suggests.
The skill depends on an external CLI that is not included or installed by these artifacts, so the user must separately trust and verify that tool.
compatibility: Requires wallapop-cli installed (Node.js 18+), network access to api.wallapop.com
Install wallapop-cli only from a trusted source, verify its version and documentation, and be especially cautious before using it with an access token.
Providing a Wallapop access token may allow account-scoped API access through the CLI, even though the documented commands are read-oriented.
The skill discloses optional credential use for Wallapop non-search endpoints; this is purpose-aligned but gives the underlying CLI account-related authority.
Optional auth token for non-search endpoints: - `WALLAPOP_ACCESS_TOKEN`
Use the token only when necessary, keep it out of shared logs or prompts, and prefer a revocable or least-privileged token if Wallapop supports that.