ClawHub

AlphaLens API

v1.0.20

Use this skill whenever the user wants to discover companies, search for products, build market maps, manage pipelines, or run enrichment workflows using Alp...

⭐ 0· 184·0 current·0 all-time
by@walidmustapha
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
VirusTotalVirusTotal
Benign
View report →
OpenClawOpenClaw
Benign
high confidence
✓
Purpose & Capability
Name/description, declared env var (ALPHALENS_API_KEY), and the API endpoints used all align: the skill is an API integrator for AlphaLens and requests only the API key needed for that service.
ℹ
Instruction Scope
The SKILL.md instructs the agent to run many curl commands, write temporary files, base64-encode favicons, and emit standalone HTML/PDF artifacts. These behaviors are consistent with building market maps and visualizations. The instructions explicitly warn not to substitute raw user input into shell commands and to only fetch favicons for public domains returned by AlphaLens, which mitigates command-injection / SSRF risks—but that safety depends on the agent actually following those constraints. Also note that the workflows encourage firing many parallel requests (& backgrounding), which can consume credits, network bandwidth, and resources.
✓
Install Mechanism
This is instruction-only with no install spec and no third-party downloads or extracted archives. Nothing is written to disk by an installer step beyond what the runtime instructions explicitly request (temporary files for output).
✓
Credentials
Only a single secret (ALPHALENS_API_KEY) is required and it directly matches the skill's integration purpose. No unrelated credentials or config paths are requested.
✓
Persistence & Privilege
The skill is user-invocable and not always-enabled; it does not request permanent presence or elevated platform privileges. Autonomous invocation is allowed by default (disable-model-invocation: false) which is normal for skills; there is no evidence it attempts to modify other skills or system-wide settings.
Assessment
This package appears coherent and implements AlphaLens API workflows as described. Before installing or running it: (1) Provide only a scoped AlphaLens API key and ensure you trust the key’s permissions and billing implications — many workflows call multiple endpoints in parallel and the SKILL warns bottom-up suites can consume 20–40 AlphaLens credits. (2) Understand it will perform outbound network requests (AlphaLens API + public favicon fetches) and write temporary files (HTML/PDF artifacts); run it in an environment where that is acceptable. (3) The SKILL.md explicitly warns not to substitute raw user input into shell commands; if you will run this skill in an environment where inputs may be untrusted, ensure the runtime enforces domain sanitization to avoid command injection or SSRF. (4) Monitor API usage / rotate the key if you suspect misuse. Overall the package is consistent with its stated purpose, but operational caution is recommended around secrets, parallel requests, and any internal/private domains that should not be fetched.

Like a lobster shell, security has layers — review code before you run it.

latestvk97e0qwy1e1ryvzyzp1fc3f7ax83s6tb

License

MIT-0
Free to use, modify, and redistribute. No attribution required.
Termshttps://spdx.org/licenses/MIT-0.html

Runtime requirements

EnvALPHALENS_API_KEY
Primary envALPHALENS_API_KEY

Comments