Surprise Buddy

PassAudited by ClawScan on May 16, 2026.

Overview

This skill is a straightforward gift-search connector to a public Surprise Buddy MCP service, with only normal external-service and product-link considerations.

This appears safe for normal gift searches. Before installing, be aware that your search criteria will be sent to Surprise Buddy and that returned product links may include marketplace or tracking query parameters.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Details about the gift search may be shared with Surprise Buddy when the tool is used.

Why it was flagged

The skill relies on a remote MCP service, so gift-search inputs such as country, age, budget, interests, and occasion are sent to that external provider.

Skill content
A live MCP HTTP server at `https://www.surprise-buddy.com/api/mcp` exposes a small set of tools
Recommendation

Avoid entering highly sensitive personal details, and treat the service as an external website/API.

What this means

Product links may include query parameters controlled by the gift database provider or marketplace.

Why it was flagged

The skill asks the agent to preserve provider-supplied product URL parameters, which may include normal marketplace, attribution, or tracking parameters.

Skill content
Do not strip query params from `product_url` — use the URL exactly as returned.
Recommendation

Review links before clicking if you care about tracking or affiliate attribution.

What this means

The reviewed files describe the intended tool, but the live service could change independently of this package.

Why it was flagged

The package contains only instructions; the actual tool behavior is provided by a live remote endpoint outside the reviewed artifact contents.

Skill content
Live MCP endpoint: `https://www.surprise-buddy.com/api/mcp`
Recommendation

Use it for ordinary gift browsing, and rely on the provider’s website/API trustworthiness for live results.