Ohio State API

AdvisoryAudited by Static analysis on Apr 30, 2026.

Overview

No suspicious patterns detected.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

NoteHigh Confidence

ASI02: Tool Misuse and Exploitation

What this means

The agent may retrieve and summarize public OSU API data, including directory or campus service results, when asked.

Why it was flagged

The skill directs the agent/user to make outbound HTTP requests and expose API results as tool output. This is expected for the stated public OSU data purpose and is scoped in examples to content.osu.edu.

Skill content

Use the bundled fetch helper to pull JSON from OSU Content APIs... `curl -sS -H 'accept: application/json' 'https://content.osu.edu/v2/api/v1/dining/locations'`

Recommendation

Use the skill for intended OSU public-data lookups and review raw results before relying on them for important decisions.

NoteHigh Confidence

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If you choose the MCP server option, your system will install npm packages needed to run the local server.

Why it was flagged

The optional MCP server setup asks the user to install Node dependencies and build local code. This is disclosed and purpose-aligned, but it introduces normal package-supply-chain considerations.

Skill content

Build it:
- `cd ohio-state-api/mcp-server && npm install && npm run build`

Recommendation

Install from a trusted copy of the skill, review package.json/lockfile if desired, and prefer reproducible installs when configuring the MCP server.