Mercado Público ChileCompra

Operate and assist across Chile's Mercado Público / ChileCompra supplier workflows using both the public API and the private supplier portal. Use when search...

This skill appears coherent and implements a read-only API helper plus conservative guidance for interacting with the private portal. Before installing: 1) Treat MERCADO_PUBLICO_API_TICKET as sensitive — provide it via secure secret storage and avoid committing it to repos. 2) If you plan to automate OTP retrieval, explicitly choose and verify the mailbox integration (Gmail/Graph/other) — the skill does not include mailbox credentials and requires you to configure and validate that provider; granting mailbox access to an agent is a separate consent decision. 3) The helper can write local cache files under skills/.../run/api-cache when you enable cache — set --cache-ttl 0 (default) if you don't want local persistence. 4) The skill’s guardrails state it will ask for explicit confirmation before any state-changing portal actions; verify that in your deployment/policy if you are restricting autonomous actions. 5) If you need higher assurance, review the included script (scripts/mercado_publico_api.py) yourself — it only calls the documented public API endpoints and contains retry/cache logic. Overall there are no unexplained environment accesses, remote install URLs, or covert exfiltration behaviors in the package.

Type: OpenClaw Skill Name: mercado-publico-chilecompra Version: 1.0.1 The skill bundle is a specialized tool for operating Chile's Mercado Público (ChileCompra) procurement portal. It includes a Python helper script (mercado_publico_api.py) for interacting with the official public API and extensive markdown documentation for navigating the supplier portal. While the skill handles sensitive authentication flows (ClaveÚnica and email-based OTP), the instructions in SKILL.md and the references/ directory consistently emphasize safety guardrails, requiring explicit human confirmation before any state-changing actions (e.g., submitting bids or accepting orders). The code is transparent, uses environment variables for secrets, and lacks any indicators of data exfiltration, obfuscation, or unauthorized execution.