Zillow × Airbnb Matcher

Find properties for sale that are already generating Airbnb income. Cross-references Zillow listings with active Airbnb rentals using geo-matching and calcul...

This skill appears to do what it says: it uses a RapidAPI key to call Airbnb + Zillow endpoints, matches listings, and prints investment metrics. Before installing: 1) Confirm you obtained the skill from a trusted source (the repo/source is marked unknown here). 2) Use demo mode first (no API key) to verify behavior. 3) Create a dedicated RapidAPI key or account you are comfortable using for this skill; do not reuse sensitive credentials. 4) Review package-lock.json and consider running npm install in an isolated environment (container or VM) if you have risk concerns about third-party npm packages. 5) Verify the .env file lives inside the skill folder (not a global/shared .env) and rotate the RapidAPI key if it was shared elsewhere. If you want to be extra cautious, inspect src/zillow.js to confirm the exact RapidAPI host used for Zillow before running live searches.

Type: OpenClaw Skill Name: zillow-airbnb-matcher Version: 3.1.0 The skill bundle appears benign. It is designed to cross-reference Zillow and Airbnb listings using RapidAPI, requiring a user-provided API key stored in a local `.env` file. All network calls are directed to legitimate RapidAPI endpoints as described in the documentation. There is no evidence of data exfiltration to unauthorized destinations, malicious execution, persistence mechanisms, obfuscation, or prompt injection attempts against the OpenClaw agent. A minor shell injection vulnerability exists in `scripts/install.sh` due to unsanitized use of `RAPIDAPI_KEY` in `sed` and `echo` commands, but this is a flaw in input handling rather than an indicator of intentional malice, especially given the expected alphanumeric nature of an API key.