StripFeed
Security checks across static analysis, malware telemetry, and agentic risk
Overview
StripFeed is a coherent URL-to-Markdown API wrapper, but users should remember that requested URLs and fetched content are sent to StripFeed and may be cached.
This skill appears safe for its advertised purpose. Before installing, make sure you are comfortable sending requested URLs and fetched page content to StripFeed, protect the STRIPFEED_API_KEY, and avoid using it on private or secret-bearing URLs unless you trust the service's handling and caching policies.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
VirusTotal findings are pending for this skill version.
Risk analysis
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
The agent may make network requests to StripFeed for URLs it is asked to read, which can consume API quota and disclose the requested URL to the provider.
The skill instructs the agent to use curl with a target URL parameter. This is central to the stated purpose, but the URL should be encoded and treated as user-controlled input.
curl -s "https://www.stripfeed.dev/api/v1/fetch?url=URL_HERE" \
Use the skill for intended web-reading tasks, avoid placing secrets in URLs, and ensure target URLs are properly URL-encoded before use.
Anyone or any agent process with access to this environment variable can use the associated StripFeed account and quota.
The skill requires an API key and sends it as a bearer token to StripFeed. This is expected for the service and no artifact shows hardcoding or leakage.
All requests require the `STRIPFEED_API_KEY` environment variable. Pass it as a Bearer token:
Store the API key securely, limit access to the environment variable, and monitor usage/quota in the StripFeed account.
URLs and page content submitted through the service may be processed and temporarily cached by StripFeed.
The provider-side service may cache fetched responses. This is disclosed and purpose-aligned, but it affects how sensitive URLs or fetched content should be handled.
Responses are cached for 1 hour by default. Use `cache=false` for real-time content.
Prefer this skill for public or non-sensitive pages; avoid private, signed, or token-bearing URLs unless you have reviewed StripFeed's privacy and caching behavior.