pick the best - shopping assistant

Pick the Best - Personal shopping assistant for product search, price comparison, and recommendations powered by Pick the Best

This skill is internally consistent with being a shopping assistant, but you should verify a few practical things before enabling it: 1) Confirm you trust the external endpoint (https://pickthebest.com) — all API calls go there. 2) Expect affiliate-tracked product URLs as the README states; if you don’t want affiliate tags, ask the maintainer. 3) The skill claims 'no personal data is sent' but multi-turn session IDs and user queries could include personal info — avoid sending sensitive data in queries. 4) Clarify market coverage (SKILL.md vs README disagree on US/AU support) if you need searches outside GB/DE/PL/FR. 5) Test with non-sensitive queries first to confirm behavior and latency. If you need stronger assurance, request the skill author to provide an authoritative API spec, privacy policy, and an explicit list of markets supported.

Type: OpenClaw Skill Name: pick-the-best-shopping-assistant Version: 1.0.0 The skill exhibits suspicious behavior by explicitly instructing the AI agent in SKILL.md to use the 'bash' tool to execute 'curl' commands for all API interactions, bypassing the standard and safer MCP (Model Context Protocol) server communication defined in .mcp.json. This requirement for high-privilege shell access to perform basic web requests is an unnecessary security risk and a common vector for command injection or remote code execution if the API response (from pickthebest.com) contains malicious content. Additionally, there is a contradiction between the README.md, which claims to use standard MCP integration, and the SKILL.md, which mandates raw bash execution.