Wallapop Cli

Use the wallapop CLI to search listings, fetch item details, view user profiles, and list categories. Apply when a user asks for Wallapop marketplace data or when you need CLI commands and flags for wallapop-cli usage.

This skill appears to be a straightforward CLI usage guide for wallapop-cli, but the SKILL.md and the skill metadata disagree: the instructions require wallapop-cli (Node.js 18+) and mention env vars (including an access token), while the metadata lists no binaries or env requirements. Before installing or running anything: (1) confirm the official source for wallapop-cli (npm or project repo) and install it from a trusted upstream; (2) ask the publisher to update the skill metadata to declare required binaries and env vars; (3) only provide a WALLAPOP_ACCESS_TOKEN if you trust the CLI source—inspect what scopes that token grants and avoid pasting high-privilege tokens into unknown tools; (4) if you plan to run the CLI, prefer using --json and script-safe checks for exit codes; (5) because the skill source/homepage is unknown, exercise caution and review the actual wallapop-cli package code before granting network credentials or tokens.

Type: OpenClaw Skill Name: wallapop-cli Version: 0.1.0 The skill bundle is benign. It provides instructions for using a `wallapop-cli` tool, detailing its commands and configuration. While it mentions `WALLAPOP_ACCESS_TOKEN` as an optional environment variable for the CLI tool, there are no instructions in `SKILL.md` for the AI agent to read, exfiltrate, or misuse this token. All commands specified are direct invocations of `wallapop`, and there are no signs of prompt injection, malicious execution, data exfiltration, or obfuscation.