WoW Lookup
v1.0.0Look up World of Warcraft characters — M+ scores, best runs, raid progression, gear, and more. Uses Raider.io (free), with optional Blizzard API and Warcraft...
⭐ 1· 559·2 current·2 all-time
byTag@tag-assistant
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
Name, description, and runtime commands all align with a World of Warcraft character lookup tool (Raider.io, optional Blizzard and Warcraft Logs integration). Requested runtime tools (curl, jq) and optional OAuth credentials match the described external services.
Instruction Scope
The SKILL.md instructs the agent to run a local 'wow' CLI (e.g., 'wow lookup ...') but the skill bundle contains no binary or code implementing that CLI. The instructions also include an install step that creates a symlink to $(pwd)/wow — which implies a local executable that is not present in the package. This mismatch means the runtime instructions are incomplete or inconsistent.
Install Mechanism
The only install action in the SKILL.md is a shell symlink: 'ln -sf $(pwd)/wow /usr/local/bin/wow'. That writes into a system-wide path (/usr/local/bin) and will require appropriate permissions; it can also overwrite an existing /usr/local/bin/wow. The command references a local file in the current working directory that is not included in the skill bundle, increasing the chance of failure or misuse if executed blindly.
Credentials
No required secrets are listed. Optional environment variables (BLIZZARD_CLIENT_ID/SECRET, WCL_CLIENT_ID/SECRET) are appropriate for the optional integrations named in the description. Declared config defaults (WOW_REGION, WOW_CONFIG) are reasonable.
Persistence & Privilege
The symlink install modifies a system-wide PATH location, creating persistent system presence outside the skill runtime. Although 'always' is false and autonomous invocation is normal, this install step grants the skill the ability to place or replace a binary on the system, which is more privilege than expected for an instruction-only descriptor.
What to consider before installing
Do not install or run the symlink command as-is. The SKILL.md expects a local 'wow' CLI but the package contains no executable — the install step would create /usr/local/bin/wow pointing at $(pwd)/wow, which could fail or overwrite an existing binary. Ask the publisher for source code or a release (GitHub/github releases, official project site) before proceeding. If you still want to try it, inspect the 'wow' binary first (from a trusted source), avoid running the ln command with elevated privileges until you verify its target, and only provide Blizzard or Warcraft Logs credentials if you trust the skill's origin. Consider running in a sandbox or container and request the skill author to include code or a trustworthy install mechanism (e.g., official release URL or package manager).Like a lobster shell, security has layers — review code before you run it.
latestvk97d69rx3hxhjwegrvkfdgfjph81aqna
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
⚔️ Clawdis
Binscurl, jq