BestChange

PassAudited by ClawScan on May 10, 2026.

Overview

This looks like a purpose-aligned BestChange lookup skill, with the main consideration being that exchange queries are sent to a hosted MCP service.

This skill appears reasonable if you want BestChange lookup help, but treat it as a third-party hosted finance data integration. Do not share personal account details or private identifiers in prompts, and verify exchangers and rates directly before making any transaction.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

What this means

Using the skill means trusting the hosted MCP server to return accurate BestChange data and behave as described.

Why it was flagged

The skill depends on a hosted external MCP server rather than local reviewed code; this is disclosed and central to the skill's purpose.

Skill content
This skill requires the hosted BestChange MCP server to be connected in the agent client.
Recommendation

Only connect the MCP endpoint if you trust the provider and verify important exchanger/rate information before acting on it.

What this means

The MCP provider can see the exchange assets, payout rails, amounts, and related query details you ask the agent to look up.

Why it was flagged

The agent sends BestChange search and quote requests to this hosted MCP endpoint, including exchange pair and amount details.

Skill content
POST https://bestchange-mcp.krutovoy.me/mcp
Recommendation

Avoid including unnecessary personal information in exchange lookup requests, and review the provider's trustworthiness before use.

What this means

Failed or blocked requests may be stored outside the chat by the hosted service for debugging or product improvement.

Why it was flagged

The blocker-reporting tool may send and retain the user's original request for later analysis, which could include financial intent or transaction details.

Skill content
`user_task` string, required. The user's original request. Why needed: preserves intent for later analysis.
Recommendation

Do not include sensitive personal identifiers or private account details in requests; providers should minimize and clearly document retention of blocker reports.