CardSnap
v1.0.0Digital Business Card Generator — create, manage, and track shareable business cards with analytics.
⭐ 0· 25·0 current·0 all-time
byToolWeb@krishnakumarmahadevan-cmd
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
medium confidencePurpose & Capability
Name, description, SKILL.md and openapi.json consistently describe a card creation/management/analytics API. There are no unexpected environment variables, binaries, or config paths requested that would be disproportionate to this purpose. Note: the skill has no source/homepage listed, so publisher provenance is unknown.
Instruction Scope
SKILL.md gives request/response examples and full OpenAPI paths and schemas and stays within the card/analytics domain. It does not instruct the agent to read local files, env vars, or other system state. However, the instructions do not supply a base API URL or authentication mechanism—the agent will need to ask the user for the endpoint and any credentials. Also marketing claims (e.g., 'CISSP-certified infrastructure') are unverified in the bundle.
Install Mechanism
Instruction-only skill with no install spec and no code files; nothing is written to disk and no external packages are downloaded.
Credentials
The skill requests no environment variables, credentials, or config paths. The API surfaces described would normally require a service URL and possibly auth, but none are declared here—this is a missing configuration detail rather than an overbroad credential request.
Persistence & Privilege
always is false and the skill does not request persistent system privileges. Model invocation is enabled by default (normal). There is no sign the skill would modify other skills or system-wide settings.
Assessment
This skill appears coherent with its stated purpose, but before installing: 1) confirm the API host and authentication method (the SKILL.md/openapi.json don't include a base URL or auth scheme), 2) verify the publisher or a homepage since the source is unknown, and 3) consider privacy implications of storing personal contact details and enabling analytics (views/shares). If you plan to use sensitive personal or customer data, ask for the service's privacy policy and where data will be hosted.Like a lobster shell, security has layers — review code before you run it.
latestvk97cz26mbr38qegb8arf75ydq1848q7n
License
MIT-0
Free to use, modify, and redistribute. No attribution required.