Luca Assistant
v1.0.1Credit card rewards optimizer — query 150+ cards, compare benefits, track portfolio, check 5/24 status, and get the best sign-up bonuses (撸卡助手)
⭐ 0· 92·0 current·0 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (credit card rewards optimizer) aligns with the files and instructions: scripts call a luca-mcp tool, the database lives at ~/.local/share/luca/luca.db, and MCP tool names match the described capabilities (card queries, portfolio tracking, enrichment). Required binaries (python3, uv) are used by the provided scripts and the declared install mechanism.
Instruction Scope
SKILL.md instructs only to install the package, run its MCP server, and call the declared tools. The enrichment workflow explicitly tells the agent to do web searches on public sites to fill missing card multipliers — this is scope-consistent for a data enrichment feature. The scripts read/write only the skill's data directory and do not attempt to access unrelated system paths or other credentials.
Install Mechanism
Installation uses 'uv tool install luca-assistant' (PyPI package). Installing a package from PyPI is expected for a Python-based tool, but PyPI packages can contain arbitrary code: verify the luca-assistant PyPI package (and the referenced GitHub repo) before installing. The install writes binaries to ~/.local/bin, which is standard for user-level CLI tools.
Credentials
The skill declares no required credentials or config paths. The scripts optionally use DB_PATH and standard user-local paths under $HOME. There are no requests for unrelated secrets or cloud credentials.
Persistence & Privilege
always:false and user-invocable:true (normal). The skill suggests adding an MCP entry for convenience but does not request or modify other skills' configs. It does not demand always-on presence or elevated privileges.
Assessment
This skill appears coherent for a credit-card rewards assistant. Before installing: 1) Inspect the luca-assistant PyPI package and the GitHub repo (https://github.com/troyt-666/luca-assistant) to ensure the code is trustworthy; PyPI packages can execute arbitrary code at install time. 2) Confirm what the 'uv' tool is on your system (uv is the declared installer) and that you trust it. 3) Be aware the setup runs 'luca init' which will download Offer Optimist data and the MCP server may perform network requests when importing/enriching data or when you follow the enrichment workflow (web searches). 4) If you want to be cautious, run installation in an isolated environment or VM and inspect the installed binaries (luca, luca-mcp) before adding the skill to persistent agent configs. The skill does not request external credentials or attempt to access unrelated system files.Like a lobster shell, security has layers — review code before you run it.
latestvk973jgw2fca9jcqd95y7fpqb2583dh8k
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
💳 Clawdis
OSmacOS · Linux
Binspython3, uv
Install
uv
Bins: luca, luca-mcp
uv tool install luca-assistant