Claimback Radar

Scans emails and bills to extract billing data, detect refund opportunities, subscription risks, and generate actionable savings recommendations.

Security Scan

This skill is internally consistent with its stated purpose: it sends user-provided email/bill text to the OpenAI API to extract billing/subscription data and generate recommendations; it requires an OpenAI API key and does not request other credentials or hidden network endpoints.

Purpose & Capability

Name/description match the implementation: code and prompts implement extraction + risk detection and produce action receipts. The skill legitimately needs access to the OpenAI API to perform its work. One minor metadata inconsistency: the package registry metadata at the top lists no required env vars, but both SKILL.md and the code require an OPENAI_API_KEY.

Instruction Scope

Runtime instructions and code stay within scope: they read an input JSON (user-provided text), load a system prompt, and send those messages to OpenAI. The SKILL.md and README explicitly state that user content is transmitted to OpenAI and warn about .env usage. There are no instructions to read unrelated system files, other credentials, or to transmit data to endpoints other than OpenAI.

Install Mechanism

No install script is provided (instruction-only at registry level) and the project lists standard Python dependencies (openai, python-dotenv) in pyproject/requirements — proportional to the task. There are no downloads from arbitrary URLs or extraction steps.

Credentials

The skill requires a single credential (OPENAI_API_KEY), which is appropriate for an OpenAI-backed text-processing skill. However, registry metadata omitted listing this required env var while SKILL.md and code both require it — the omission is an inconsistency to be aware of but not evidence of malice.

Persistence & Privilege

The skill does not request always:true and does not modify other skills or system settings. It operates only when invoked and uses no elevated or persistent privileges beyond calling the OpenAI API.

Assessment

Things to consider before installing: - You must provide an OPENAI_API_KEY (the code and SKILL.md require it). The registry metadata omission is likely an oversight — confirm you supply the key securely. - This skill sends the email/bill text you pass to OpenAI. Do not feed highly sensitive personal data or secrets unless you accept OpenAI's data handling and retention policies. - main.py will load a local .env if present and warns you; avoid storing real API keys in .env files that might be committed to source control. - Prefer injecting the API key explicitly when running in production (as noted by the README) and review prompts/system.txt to ensure it meets your privacy expectations. - If you want extra assurance, run the included tests locally (they mock OpenAI) and audit the prompts and examples for any PII leakage patterns before using with real emails.

Skill Definition: claimback_radar

REQUIRED CREDENTIAL: OPENAI_API_KEY environment variable (or pass api_key directly to ClaimbackRadar).
EXTERNAL DATA FLOW: User-provided text content is transmitted to OpenAI's API. Review OpenAI's data retention and privacy policies before use.

---

Description

Scans user emails and bills to discover hidden refunds, subscription traps, and savings opportunities.

Functions

Function 1: extract

Extracts structured subscription / billing data from unstructured text.

Input: Raw email or bill text Output: confirmation_card (JSON)

Function 2: detect_and_recommend

Detects risks and generates actionable receipts.

Input: confirmation_card + user context Output: action_receipts + risk_flags

Invocation Schema

See schema/input.json

Output Schema

See schema/output.json

Example

See examples/netflix_email.md

Security Notes

• The CLI entrypoint (main.py) explicitly loads .env if present and warns the user.
• Do not commit .env files containing real API keys to version control.
• For production use, prefer explicit api_key injection over implicit environment loading.