Find properties for sale that are already generating Airbnb income. Cross-references Zillow listings with active Airbnb rentals using geo-matching and calcul...
Security Analysis
medium confidenceThe skill's files, install steps, and required RapidAPI key are consistent with its stated purpose (cross-referencing Zillow + Airbnb via RapidAPI); nothing in the code suggests hidden exfiltration or unrelated credential access, though the registry metadata and SKILL.md disagree about required env vars and the source is unknown so exercise normal caution.
Name/description (match Zillow and Airbnb listings) align with what the code does: fetches Zillow and Airbnb data via RapidAPI and performs geo- and address-matching. Required binary (node) and the RAPIDAPI_KEY declared in SKILL.md are appropriate for this purpose.
Runtime instructions and scripts are scoped to the skill directory: the install script runs npm install, writes/updates a .env in the skill folder, and the JS code loads .env only from that folder. The commands perform network requests only to RapidAPI-hosted Airbnb and Zillow endpoints (airbnb13.p.rapidapi.com and the Zillow RapidAPI provider). The instructions don't ask the agent to read unrelated system files or other credentials.
No remote binary download; install runs the included scripts/install.sh which executes npm install (pulls packages from the public npm registry). This is a common and expected pattern but does carry the normal npm risk surface (third-party dependencies in package-lock.json). There are no obscure external download URLs or extract-from-arbitrary-URL steps.
The skill requires one API key (RAPIDAPI_KEY) in SKILL.md/.env which is proportionate to the stated functionality. However, registry metadata at the top of the report lists 'Required env vars: none' while SKILL.md and scripts clearly require RAPIDAPI_KEY — this metadata mismatch is an inconsistency to be aware of. No other secrets or unrelated credentials are requested.
The skill does not request always:true and does not modify system-wide settings; it stores configuration (RAPIDAPI_KEY) in a .env file inside the skill folder (expected). It can be invoked autonomously by the agent (platform default) but that is normal and not excessive here.
Guidance
This skill appears to do what it says: it uses a RapidAPI key to call Airbnb + Zillow endpoints, matches listings, and prints investment metrics. Before installing: 1) Confirm you obtained the skill from a trusted source (the repo/source is marked unknown here). 2) Use demo mode first (no API key) to verify behavior. 3) Create a dedicated RapidAPI key or account you are comfortable using for this skill; do not reuse sensitive credentials. 4) Review package-lock.json and consider running npm install in an isolated environment (container or VM) if you have risk concerns about third-party npm packages. 5) Verify the .env file lives inside the skill folder (not a global/shared .env) and rotate the RapidAPI key if it was shared elsewhere. If you want to be extra cautious, inspect src/zillow.js to confirm the exact RapidAPI host used for Zillow before running live searches.
Latest Release
v3.1.0
Fixed registry metadata: declared RAPIDAPI_KEY env var, install spec, and node requirement. Resolves security scan warnings.
Popular Skills
Published by @Freemountaindeer on ClawHub
