StripFeed
Analysis
StripFeed is a coherent URL-to-Markdown API wrapper, but users should remember that requested URLs and fetched content are sent to StripFeed and may be cached.
Findings (3)
Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.
Checks for instructions or behavior that redirect the agent, misuse tools, execute unexpected code, cascade across systems, exploit user trust, or continue outside the intended task.
curl -s "https://www.stripfeed.dev/api/v1/fetch?url=URL_HERE" \
The skill instructs the agent to use curl with a target URL parameter. This is central to the stated purpose, but the URL should be encoded and treated as user-controlled input.
Checks whether tool use, credentials, dependencies, identity, account access, or inter-agent boundaries are broader than the stated purpose.
All requests require the `STRIPFEED_API_KEY` environment variable. Pass it as a Bearer token:
The skill requires an API key and sends it as a bearer token to StripFeed. This is expected for the service and no artifact shows hardcoding or leakage.
Checks for exposed credentials, poisoned memory or context, unclear communication boundaries, or sensitive data that could leave the user's control.
Responses are cached for 1 hour by default. Use `cache=false` for real-time content.
The provider-side service may cache fetched responses. This is disclosed and purpose-aligned, but it affects how sensitive URLs or fetched content should be handled.