track-tariff-trends
Retrieve MFN applied tariff-rate timeseries for a reporting country — applied vs bound rates by year, plus the optional US effective tariff rate. Use when the user asks how a country's MFN tariffs have changed over time.
74
93%
Does it follow best practices?
Run evals on this skill
Adds up to 20 points to the overall score
View guide
High
Do not use without reviewing
Security
2 findings: 2 high severity. You should review these findings carefully before considering using this skill.
W007: Insecure credential handling detected in skill instructions.
What this means
The skill handles credentials insecurely by requiring the agent to include secret values verbatim in its generated output. This exposes credentials in the agent’s context and conversation history, creating a risk of data exfiltration.
Why it was flagged
The skill explicitly requires an API key in the X-WorldMonitor-Key header and even includes a literal example key (wm_012345...), which creates a risk the LLM will output or propagate secret values verbatim (despite a safer env-var curl example elsewhere).
W008: Secret detected in skill content (API keys, tokens, passwords).
What this means
Detected sensitive credentials directly embedded within the skill content, such as API keys, access tokens, private keys, or service-specific secrets. Secrets should never be hardcoded in plain text within skill instructions.
Why it was flagged
I flagged the literal header value on line 12 because it is a long, random-looking API key (starts with "wm_" followed by a hex-like string) — not a documentation placeholder like "YOUR_API_KEY" or a redaction marker. It meets the definition of a high-entropy, directly-present credential that could be used to access the service. Other items (e.g., the curl example using the environment variable $WM_API_KEY) are not secrets in the document and were ignored.
- Repository
- koala73/worldmonitor
- Commit
23ab7d1
- Audited
- Security analysis
Is this your skill?
If you maintain this skill, you can claim it as your own. Once claimed, you can manage eval scenarios, bundle related skills, attach documentation or rules, and ensure cross-agent compatibility.