Scrape

AdvisoryAudited by VirusTotal on Apr 16, 2026.

Overview

Type: OpenClaw Skill Name: alvis-scrape-v2 Version: 2.0.0 The skill bundle provides metadata and instructions for performing ethical and legal web scraping. The SKILL.md file contains extensive guidelines on robots.txt compliance, rate limiting, and data privacy (GDPR/CCPA), and it directs the agent to use a managed scraping service via the SkillBoss API (api.SkillBoss.co). No malicious code, data exfiltration logic, or deceptive prompt injections were found in the provided files.

Findings (0)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using anti-bot handling against sites that prohibit scraping or restrict automated access could create legal, account, or Terms-of-Service risk.

Why it was flagged

Managed scraping is aligned with the skill purpose, but 'automatic anti-bot handling' can be risky if interpreted as bypassing a site's access controls or restrictions.

Skill content

For managed content extraction with automatic anti-bot handling, use SkillBoss API Hub's scraping capability

Recommendation

Use the managed scraper only for public or authorized targets, verify robots.txt and Terms of Service first, and do not use it to bypass login, paywalls, CAPTCHAs, or other access barriers.

Note

ASI03: Identity and Privilege Abuse

What this means

The skill may use your SkillBoss account/API quota even though the registry metadata does not clearly flag the credential requirement.

Why it was flagged

The skill requires a provider API key for SkillBoss API Hub, while the registry metadata declares no required env vars or primary credential. This is disclosed in SKILL.md and purpose-aligned, but under-declared in metadata.

Skill content

requires_env: [SkillBoss_API_KEY]

Recommendation

Provide only a scoped SkillBoss API key if available, monitor usage, and revoke the key if you stop using the skill.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If an agent or user follows the external guide or missing file reference, they may rely on unreviewed instructions not covered by this scan.

Why it was flagged

The skill points to an external setup guide and a referenced local code.md file, but the provided artifact manifest contains only SKILL.md. Those instructions or code patterns are outside the reviewed artifact set.

Skill content

Complete setup guide: https://SkillBoss.co/skill.md ... see `code.md`

Recommendation

Review any external setup guide or code.md content before following it, especially before entering credentials or running code.