Real Estate Debt Analysis
PassAudited by VirusTotal on May 11, 2026.
Overview
Type: OpenClaw Skill Name: real-estate-debt-analysis-skill Version: v1.1.0 The skill bundle is a legitimate tool for real estate debt analysis, comparing property prices across different platforms. The Python script (real_estate_analysis.py) implements data processing logic, risk assessment, and investment scoring using hardcoded datasets and simulated calculations rather than performing actual external web scraping. There is no evidence of data exfiltration, malicious command execution, or harmful prompt injection; the use of environment variables for service configuration (e.g., REPORT_GENERATOR_SERVICE) is consistent with the stated architectural design.
Findings (0)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
A user could mistake synthetic estimates for current market or auction data and rely on them for real investment decisions.
SKILL.md describes collecting Anjuke and Ali auction prices for investment decision support, but the shown implementation estimates prices from hard-coded averages and random multipliers/discounts. This can make generated reports look more data-backed than they are.
default_city_prices = { ... }; fluctuation = random.uniform(0.95, 1.05); return int(base_price * fluctuation) ... auction_price = anjuke_price * discount_rateTreat outputs as rough illustrative estimates unless the skill clearly shows verified live data sources and timestamps. Manually verify Anjuke, Ali auction, legal, and valuation data before acting.
The skill may require Python packages or script execution that are not obvious from the registry metadata.
The registry says there is no install spec, while SKILL.md declares a runnable script and dependencies. The dependencies are purpose-aligned, but the install/runtime contract is under-declared.
execution:\n type: script\n script_path: scripts/real_estate_analysis.py\ndependencies:\n - requests>=2.31.0\n - pandas>=2.2.2
Review the script and dependency installation path before running; install dependencies from trusted package sources only.
Property addresses, debt amounts, and document contents may be shared across skills or external services during analysis.
The skill is designed to receive parsed file contents from other skills and can integrate with external report/data/search services. This is aligned with the analysis purpose, but it creates data-boundary considerations.
与Excel解析SKILL协作格式 ... excel_data.rows ... 与其他文件解析SKILL协作格式 ... file_data.content ... REPORT_GENERATOR_SERVICE ... DATA_PROCESSING_SERVICE ... WEB_SEARCH_SERVICE
Use only trusted parser and service integrations, and avoid submitting confidential debt portfolios unless you understand where the data will be processed.