Trade Compass

PassAudited by ClawScan on May 1, 2026.

Overview

Trade Compass is coherent for tariff and landed-cost calculations, but users should review the separate local backend and optional API keys before using it.

Before installing, review the separate backend repository and dependencies, run it in an isolated environment, configure optional API keys only if needed, and remember that the tool provides estimates that should be verified with a licensed customs broker.

Findings (3)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Low

#ASI04: Agentic Supply Chain Vulnerabilities

What this means

Using the skill requires trusting a separate repository and its dependencies, which ClawHub’s included artifact scan did not cover.

Why it was flagged

The skill’s main functionality depends on installing and running backend code that is not included in the scanned skill package.

Skill content

The skill requires a local FastAPI backend running on `http://localhost:8000`... Source code: github.com/zhaoningliu1-lang/tariff-watch ... `pip install -e ".[dev]"`

Recommendation

Review the backend repository, use a pinned release or commit, and run it in an isolated virtual environment before relying on the skill.

Low

#ASI03: Identity and Privilege Abuse

What this means

If you set these keys, the backend may make requests to paid or rate-limited external services on your behalf.

Why it was flagged

The backend can use provider API credentials from the environment, which is relevant account authority even though it is optional and purpose-aligned.

Skill content

The skill automatically detects and uses them — no code changes needed: `EXCHANGERATE_API_KEY`, `FREIGHTOS_API_KEY`

Recommendation

Only configure API keys you intend to use, prefer limited-scope or test keys where available, and monitor provider usage.

Low

#ASI10: Rogue Agents

What this means

The backend may keep updating and storing tariff, FX, and shipping data while it is running, which is expected but should be understood.

Why it was flagged

The backend performs scheduled background refreshes and writes local cache/history data when running.

Skill content

Auto-Refresh Schedule... Exchange rates Daily... Shipping rates Daily... USITC tariffs Weekly... First startup automatically backfills 30 days of FX + shipping history into SQLite.

Recommendation

Run the backend only when needed and review or configure the data directory if you want to control local storage.