Currency Converter
PassAudited by ClawScan on May 1, 2026.
Overview
This skill appears to do what it claims—convert currencies using a disclosed exchange-rate API—with no evidence of credential use, persistence, file writes, or harmful behavior.
This looks safe for normal currency-conversion use. Before installing, be comfortable with it running a local Python script and contacting exchangerate-api.com for rates; if you install Python dependencies, prefer trusted package sources and pinned versions for reproducibility.
Findings (2)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
When used, the skill may contact exchangerate-api.com to retrieve rates; the artifacts do not show it sending files, credentials, or unrelated user data.
The helper contacts a third-party exchange-rate API. This is expected for live currency rates and appears scoped to normalized currency codes.
url = f"https://api.exchangerate-api.com/v4/latest/{from_currency}"
response = requests.get(url, timeout=10)Use it for explicit exchange-rate or conversion requests, and be aware that the external API provider will see the request and network metadata.
If dependencies are installed from this requirements file, the resolved package version may vary over time.
The dependency is specified as a lower bound rather than an exact pinned version. This is common, but it gives less reproducibility if dependencies are installed.
requests>=2.25.0
For stricter supply-chain control, pin dependency versions and install packages from trusted package sources.