ToolDeck
v1.0.1Auto-scrapes URLs to extract tool/service info, auto-categorizes, and saves to a personal database. Use when user explicitly shares a URL to save or asks to...
⭐ 0· 30·0 current·0 all-time
byJahfali-dev@almohalhel1408
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
Capability signals
These labels describe what authority the skill may exercise. They are separate from suspicious or malicious moderation verdicts.
OpenClaw
Benign
high confidencePurpose & Capability
Name/description (auto-scrape, categorize, save tools) match the SKILL.md workflow. The skill asks for no credentials, no binaries, and no unusual system access — all consistent with a passive, user-initiated bookmarking/scraping tool.
Instruction Scope
Instructions are narrowly scoped to user-initiated actions: confirm intent, use web_fetch and web_search, respect robots.txt, skip authenticated/paywalled/private pages, sanitize tracking params, present for confirmation before saving. They do not instruct reading arbitrary local files or accessing unrelated credentials. Note: because this is an instruction-only skill (no executable code), the behavior depends on the agent following these textual rules.
Install Mechanism
There is no install spec and no code files to install or execute. This minimizes installation risk — nothing is downloaded or written during install.
Credentials
The skill requests no environment variables or credentials, which is appropriate. One proportionality note: it writes a persistent database file in the agent workspace (/workspace/skills/tooldeck/references/database.json) and may store extracted contact info (emails, locations). That persistent storage is expected for the stated purpose but is sensitive and worth user consideration.
Persistence & Privilege
always is false and autonomous invocation is not disabled (normal). The skill will persist user-provided data into a workspace file; this is reasonable for a bookmarking database but means saved entries are stored persistently and could be accessible to other users or skills with access to the same workspace. The skill does not request elevated platform privileges or attempt to modify other skills.
Assessment
This skill appears coherent and limited to user-initiated scraping and saving of tool/service URLs. Before installing, consider: (1) The skill saves extracted data persistently at /workspace/skills/tooldeck/references/database.json — review or delete that file if you stop using the skill. (2) Although the SKILL.md explicitly forbids scraping private or paywalled pages and says it will strip tokens and tracking params, enforcement depends on the agent following those textual rules (there's no code to audit). If you care about strict guarantees, test the skill with non-sensitive example URLs and inspect the database file to confirm only expected data is stored. (3) Be mindful that saved entries can include public contact info (emails/links) and may be visible to others with access to the same workspace. If these considerations are acceptable, the skill's behavior is proportionate to its purpose.Like a lobster shell, security has layers — review code before you run it.
latestvk971gvkjv3gg36x880dfsddpw58464ht
License
MIT-0
Free to use, modify, and redistribute. No attribution required.