Get institutional-grade CEO performance analytics for S&P 500 companies. Proprietary scores: CEORaterScore (composite), AlphaScore (market outperformance), R...
Security Analysis
high confidenceThe skill's code, runtime instructions, and requested credential (CEORATER_API_KEY) are coherent with its stated purpose of calling the CEORater API and do not request unrelated access.
The name/description advertise CEO analytics via the CEORater API and the skill only requires a single CEORATER_API_KEY to call api.ceorater.com endpoints. No unrelated services, binaries, or config paths are requested.
SKILL.md instructs the agent to call documented API endpoints (GET /v1/ceo, /v1/search, /v1/ceos, /v1/meta) and to use the CEORATER_API_KEY. The helper script calls only the api.ceorater.com domain, sanitizes input, URL-encodes queries, and enforces simple validation. There are no instructions to read unrelated files, system credentials, or send data to unexpected endpoints.
This is instruction-only (no installer). The repo contains a small helper shell script; there is no network-download install step or use of third-party package registries. Risk from installation is low.
Only one environment variable (CEORATER_API_KEY) is required and it directly maps to the service being integrated. README notes an alternate config key in openclaw.json (apiKey) which is consistent with storing credentials locally; no other secrets or unrelated credentials are requested.
The skill is not always-enabled (always:false) and registry shows disable-model-invocation:true (model cannot autonomously invoke it), limiting autonomous access. The skill does not request changes to other skills or system-wide config beyond optional local API-key configuration.
Guidance
This skill appears to do only what it claims: call the CEORater API using your CEORATER_API_KEY. Before installing, confirm you trust https://www.ceorater.com and your subscription, and avoid placing the API key in world-readable files. Keep the key secret (use environment variables or secure per-agent config), monitor usage/rate limits, and review the CEORater terms for allowed data use (enterprise restrictions on model training are noted). The helper script sanitizes input and only contacts api.ceorater.com, but remember that any skill that calls external APIs transmits queries and receives data — if you have sensitive prompts or PII, avoid sending them to third-party services.
Latest Release
v1.0.9
- Clarified CEO record coverage in the description (now "500+ CEOs") and removed reference to February 2026. - Added instructions to use the GET /v1/meta endpoint for live record count and last refresh timestamp. - Updated API documentation to include the metadata endpoint for current data stats. - No functional or code changes; documentation and usage clarification only.
Popular Skills
Published by @ceorater-skills on ClawHub
