Find API

Security checks across static analysis, malware telemetry, and agentic risk

Overview

This is an instruction-only guide for finding data APIs; it looks coherent, with only routine cautions around optional package installs and API keys.

This skill appears safe as a reference guide. Before following its examples, verify any third-party package or API provider, use a separate environment for installs, and protect any API keys you create.

Static analysis

No static analysis findings were reported for this release.

VirusTotal

VirusTotal findings are pending for this skill version.

View on VirusTotal

Risk analysis

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

#ASI04: Agentic Supply Chain Vulnerabilities

Low

What this means

If a user follows the examples, they may install external packages into their Python environment.

Why it was flagged

The skill recommends installing third-party Python packages. This is aligned with its data-API purpose, but the examples are unpinned and rely on external package provenance.

Skill content

Installation:
```bash
pip install akshare
```

Recommendation

Install only packages you need, preferably in a virtual environment, and consider pinning versions or checking package provenance before use.

#ASI03: Identity and Privilege Abuse

Low

What this means

Using some recommended APIs may require entering provider credentials or API keys.

Why it was flagged

The skill documents APIs that require provider API keys. This is expected for API access, and the artifacts do not show key logging, hardcoded secrets, or unrelated credential use.

Skill content

OpenWeatherMap | ⭐⭐⭐⭐⭐ | Free+Paid | API Key ... api_key = "YOUR_API_KEY"

Recommendation

Use least-privilege API keys, avoid pasting real secrets into chat unless necessary, and check each provider’s costs, scopes, and terms.