Web Scraper Skill
v1.0.0Use this skill to scrape, crawl, or extract data from websites using Apify or Firecrawl APIs. Trigger whenever the user wants to: scrape a URL, crawl a websi...
⭐ 0· 56·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name and description match the SKILL.md and code templates: the skill is explicitly for driving Apify and Firecrawl APIs to scrape/crawl web pages. It does not request unrelated binaries, config paths, or credentials in the registry metadata.
Instruction Scope
Runtime instructions and templates focus on calling Firecrawl and Apify endpoints, starting/polling jobs, and saving results. They include concrete HTTP examples and code templates that post URLs and receive scraped content. The SKILL.md does not warn about sending potentially sensitive/private site content to third-party APIs (data exfiltration risk), and it instructs the agent to always use this skill for scraping tasks — which could cause automatic outbound requests if combined with autonomous invocation.
Install Mechanism
Instruction-only skill (no install spec, no code files executed on install). This is the lowest-risk install model — nothing is pulled or executed at install time.
Credentials
The registry lists no required environment variables, but the SKILL.md clearly expects the user to provide Firecrawl and Apify API keys at runtime. That is proportionate to the purpose (those APIs require keys), but the skill does not declare or manage any required env vars up-front which could be confusing. It does not request unrelated credentials.
Persistence & Privilege
always:false (normal). disable-model-invocation:false allows autonomous invocation (platform default). This is expected for a skill that performs network calls, but users should be aware that the agent could call the external APIs without additional prompts when it decides scraping is required.
Assessment
This skill appears to do what it claims (drive Apify and Firecrawl). Before installing or using it, consider: (1) the agent will send URLs and scraped page content to third-party services — do not send private, behind-auth, or sensitive pages unless you trust those services and have permission; (2) the skill will ask you for API keys at runtime — treat those keys like secrets (use least-privilege tokens, rotate/revoke if needed, and avoid sharing long-lived account-wide keys); (3) if you don't want the agent to autonomously make scraping requests, restrict its ability to invoke the skill or require explicit confirmation before running; and (4) verify legal/robots/terms-of-service constraints for sites you plan to scrape.Like a lobster shell, security has layers — review code before you run it.
latestvk9782r5q0vfpt7a5b5f5f6eawd8426e7
License
MIT-0
Free to use, modify, and redistribute. No attribution required.