Skill flagged — suspicious patterns detected

ClawHub Security flagged this skill as suspicious. Review the scan results before using.

Nex Pricewatch

v1.0.0

Monitor competitor and supplier website prices using CSS, XPath, or regex selectors; track changes with alerts, view history, trends, and export data locally.

1· 77·0 current·0 all-time
byNex AI@nexaiguy

Install

OpenClaw Prompt Flow

Install with OpenClaw

Best for remote or guided setup. Copy the exact prompt, then paste it into OpenClaw for nexaiguy/nex-pricewatch.

Previewing Install & Setup.
Prompt PreviewInstall & Setup
Install the skill "Nex Pricewatch" (nexaiguy/nex-pricewatch) from ClawHub.
Skill page: https://clawhub.ai/nexaiguy/nex-pricewatch
Keep the work scoped to this skill only.
After install, inspect the skill metadata and help me finish setup.
Use only the metadata you can verify from ClawHub; do not invent missing requirements.
Ask before making any broader environment changes.

Command Line

CLI Commands

Use the direct CLI path if you want to install manually and keep every step visible.

OpenClaw CLI

Bare skill slug

openclaw skills install nex-pricewatch

ClawHub CLI

Package manager switcher

npx clawhub@latest install nex-pricewatch
Security Scan
Capability signals
CryptoCan make purchases
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Suspicious
medium confidence
Purpose & Capability
The code (scraper, storage, alerter, CLI) implements the described price-watching features and stores data locally (~/.nex-pricewatch). Metadata and files are consistent with a price-monitor tool. However the SKILL.md metadata lists a homepage (nex-ai.be) while the registry header shows 'Homepage: none' and the top-level requirements block shows no env vars even though SKILL.md declares Telegram env vars — minor metadata mismatches.
!
Instruction Scope
Runtime instructions ask the user to run setup.sh and use the CLI to add arbitrary target URLs and selectors. The scraper will fetch any URL you configure (using urllib), save HTML snapshots to ~/.nex-pricewatch/snapshots, and run regex/CSS/XPath extraction. Fetching arbitrary URLs is expected for the skill's purpose but creates SSRF/host-reachability risks if supplied with internal or sensitive endpoints. The SKILL.md does not warn about restricting target domains or internal addresses.
!
Install Mechanism
There is no formal install spec even though multiple code files are provided and SKILL.md asks to run setup.sh. The README claims 'No External Dependencies' but lib/alerter.py imports the third-party 'requests' package at module import time. The CLI imports alerter at startup, so running the tool will likely fail unless 'requests' is installed. setup.sh content is present but not shown in full — it may create the command in PATH; its actions should be reviewed before running.
Credentials
Telegram-related environment variables (NEX_PRICEWATCH_TELEGRAM_BOT_TOKEN, NEX_PRICEWATCH_TELEGRAM_CHAT_ID) are declared in SKILL.md and used in lib/config.py; they are optional (TELEGRAM_ENABLED defaults to False) and appropriate for the optional Telegram feature. However the top-level registry indicated 'Required env vars: none' which contradicts SKILL.md's metadata listing these variables (they are optional but present). No other unrelated credentials or paths are requested.
Persistence & Privilege
The skill stores data under the user's home directory (~/.nex-pricewatch) and uses an on-disk SQLite DB; it does not request 'always: true' or global agent privileges. setup.sh may create an executable entry for the CLI (per README); inspect setup.sh before running to confirm it only installs into user-local locations.
What to consider before installing
This package appears to implement the advertised price-monitoring functionality, but take these precautions before installing or running it: - Dependency: The code imports the third-party 'requests' library even though the README claims 'no external dependencies'. Install requests (pip install requests) or inspect setup.sh to see if it installs dependencies; running the CLI without requests may fail. - Review setup.sh: it likely creates the data directory and may add the command to your PATH. Open and read setup.sh to confirm it only performs the expected local setup and does not modify system-wide files. - Beware of SSRF/internal network access: the tool will fetch any URL you configure. Do not add internal/service URLs (localhost, 169.254.*, 10.* etc.) unless you understand the risk. Only monitor public competitor/supplier pages you are authorized to access. - Telegram tokens: if you enable Telegram alerts, the bot token and chat ID are necessary. Only provide those secrets if you trust the code and machine. The tokens are used only to call api.telegram.org in HTTPS requests. - Metadata mismatches: SKILL.md metadata (required env vars and homepage) and the registry header disagree — this looks like sloppy packaging rather than proven malicious intent, but you should verify the repository/source and the author before trusting it. If you want to proceed safely: inspect setup.sh and the full source files locally, install dependencies in a virtualenv, run the tool with test targets (public pages) first, and keep an eye on what files it creates under ~/.nex-pricewatch. If you cannot inspect the files or confirm the install script, treat it as untrusted.

Like a lobster shell, security has layers — review code before you run it.

latestvk9776wb8x3pe0rgf3wa0bj3f01848q3y
77downloads
1stars
1versions
Updated 3w ago
v1.0.0
MIT-0

Nex PriceWatch

Competitive Price Monitor for SMEs and Agencies. Track competitor and supplier pricing with automatic alerts, historical data, and analytics. All pricing data stays on your machine.

When to Use

Use this skill when the user asks about:

  • Tracking competitor pricing pages
  • Monitoring supplier cost changes
  • Setting up price alerts for competitors
  • Comparing your pricing against competitors
  • Historical price analysis and trends
  • Detecting when competitors change their pricing
  • Exporting price history for analysis
  • Price monitoring dashboard

Trigger phrases: "price", "pricing", "competitor", "concurrentie" (Dutch), "prijs", "tarief", "goedkoper", "duurder", "monitor", "track competitor", "price alert", "price change", "pricing comparison", "have competitors changed their prices"

Quick Setup

If the database does not exist yet, run the setup script:

bash setup.sh

This creates the data directory and initializes the SQLite database.

Available Commands

1. Add a Price Target

Add a website to monitor:

nex-pricewatch add \
  --name "Competitor X Website Package" \
  --url "https://competitor.be/pricing" \
  --competitor "WebAgency X" \
  --selector ".price-premium" \
  --selector-type css \
  --type competitor \
  --currency EUR

Parameters:

  • --name (required): Descriptive target name
  • --url (required): Full URL to monitor
  • --competitor: Competitor/company name
  • --selector-type (required): css, xpath, regex, or text
  • --selector (required): CSS class (.price), ID (#price), regex pattern, or text label
  • --type: competitor, supplier, or market (default: competitor)
  • --currency: Currency code (EUR, USD, etc.)
  • --interval: Check interval in hours (default: 24)
  • --tags: Comma-separated tags
  • --notes: Additional notes

Selector Examples:

  • CSS class: .price-tag → finds element with class "price-tag"
  • CSS ID: #pricing → finds element with id "pricing"
  • Regex: \€[\d.,]+ → finds currency amounts
  • Text label: Prijs → finds price near text label

2. Check Prices Now

nex-pricewatch check
nex-pricewatch check --name "Competitor X Website Package"
nex-pricewatch check --alerts
nex-pricewatch check --alerts --telegram

Check current prices for all or specific targets. Shows success/failure and any price changes.

3. List Targets

nex-pricewatch list

Shows all configured targets with current prices and status.

4. Show Target Details

nex-pricewatch show "Competitor X Website Package"

Display detailed information including:

  • Target configuration
  • Current and previous prices
  • Recent price history
  • Price statistics (min, max, avg, trend)

5. Price History

nex-pricewatch history "Competitor X Website Package"
nex-pricewatch history "Competitor X Website Package" --since 2026-01-01
nex-pricewatch history "Competitor X Website Package" --limit 20

View complete price history with timestamps and raw extracted text.

6. Recent Changes

nex-pricewatch changes
nex-pricewatch changes --since 2026-01-01

Show all detected price changes with percentages and dates.

7. Compare Pricing

nex-pricewatch compare

Side-by-side view of all competitor pricing organized by company.

8. Dashboard View

nex-pricewatch dashboard

Full monitoring dashboard with all tracked prices, trends, and status.

9. Remove Target

nex-pricewatch remove "Competitor X Website Package"
nex-pricewatch remove "Competitor X Website Package" --force

Remove a price target and its history.

10. Export History

nex-pricewatch export "Competitor X Website Package"
nex-pricewatch export "Competitor X Website Package" --format csv
nex-pricewatch export "Competitor X Website Package" --output prices.json

Export price history as JSON or CSV for external analysis.

11. Statistics

nex-pricewatch stats

Overall statistics including:

  • Total targets configured
  • Number of price changes (30 days)
  • Biggest price increase
  • Biggest price decrease

12. Configuration

nex-pricewatch config

Display current configuration settings.

Alert Configuration

Alerts are automatically generated when:

  • Price increases by more than 5%
  • Price decreases by more than 10%

Adjust these thresholds in lib/config.py:

ALERT_INCREASE_PCT = 5
ALERT_DECREASE_PCT = 10

Telegram Notifications (Optional)

To enable Telegram alerts:

  1. Create a Telegram bot via @BotFather
  2. Set environment variables:
    export NEX_PRICEWATCH_TELEGRAM_BOT_TOKEN="your_bot_token"
    export NEX_PRICEWATCH_TELEGRAM_CHAT_ID="your_chat_id"
    
  3. Enable in config: TELEGRAM_ENABLED = True

Data Storage

All price data is stored locally at ~/.nex-pricewatch/:

  • pricewatch.db - SQLite database with all targets, prices, and alerts
  • snapshots/ - HTML snapshots for comparison

Supported Selectors

CSS Selectors

Simple CSS selector matching:

  • .price - class selector
  • #price - ID selector
  • span.amount - tag with class
  • Works with common price page structures

XPath

Basic XPath support:

  • //div[@class='price']/span
  • //span[@id='price']

Regex

Full regex pattern matching:

  • \€[\d.,]+ - Euro amounts
  • \$\d{2,4}(\.\d{2})? - Dollar amounts
  • \d+\s*(?:euro|EUR) - Numbers followed by currency

Text Labels

Find price near text labels:

  • Prijs - finds "Prijs: €1.499,00"
  • Price - finds "Price: $99.99"
  • Tarif - finds "Tarif: 1999 EUR"

Interpreting Results

Price changes show:

  • ⬆️ +X%: Price increased
  • ⬇️ -X%: Price decreased
  • 🔔: New price tracking started

Trends indicate direction:

  • UP: Recent prices higher than historical average
  • DOWN: Recent prices lower than historical average
  • STABLE: Consistent pricing

Examples

Track WebAgency Competitor Pricing

nex-pricewatch add \
  --name "WebAgency X Standard Package" \
  --url "https://webagency-x.be/pricing" \
  --competitor "WebAgency X" \
  --selector ".pricing-card:nth-child(2) .price" \
  --selector-type css

nex-pricewatch check --alerts

Monitor Supplier Material Costs

nex-pricewatch add \
  --name "Steel supplier A - 10mm plate" \
  --url "https://supplier-a.com/catalog/steel" \
  --type supplier \
  --selector "table.prices tr:contains('10mm') .price" \
  --selector-type css

nex-pricewatch history "Steel supplier A - 10mm plate" --since 2025-12-01

Market Rate Tracking

nex-pricewatch add \
  --name "EURIBOR 12M Rate" \
  --url "https://www.euribor-rates.eu/" \
  --type market \
  --selector ".euribor-12m-rate" \
  --selector-type css

nex-pricewatch dashboard

Export for Analysis

nex-pricewatch export "WebAgency X Standard Package" --format csv --output ~/analysis.csv

Troubleshooting

Price Not Extracting

  1. Check URL: Ensure the URL is correct and accessible
  2. Inspect page: Right-click → Inspect to find correct selector
  3. Test selector: Try different selector types (css, xpath, regex)
  4. Use regex: If static selectors fail, use regex: \€[\d.,]+

JavaScript-Heavy Sites

If the site loads prices with JavaScript:

  1. Try regex selector: \€[\d.,]+
  2. Or provide the actual HTML view source selector
  3. Advanced: Use playwright (optional dependency) for dynamic sites

Currency Parsing Issues

If currency not detected:

  1. Specify explicit --currency code
  2. Ensure price format includes currency symbol or code
  3. Supported: EUR, USD, GBP, JPY, CNY, INR, etc.

Privacy & Security

  • All data stored locally in ~/.nex-pricewatch/
  • No data sent to external services (except optional Telegram)
  • Uses standard HTTP with proper user-agent
  • Snapshots stored for comparison purposes only

Technical Details

  • Database: SQLite (lib/storage.py)
  • Scraper: Python urllib + regex (lib/scraper.py)
  • Alerts: Threshold-based detection (lib/alerter.py)
  • No external dependencies: Uses Python stdlib only
  • Optional: Playwright for JavaScript-heavy sites

License

MIT-0 License - Copyright 2026 Nex AI (Kevin Blancaflor)

Comments

Loading comments...