Crawl
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's functionality (remote crawling via Tavily) is coherent, but the packaging and documentation contain inconsistencies and a missing declared credential — and it will send crawled pages to a third‑party service, so you should verify trust and key handling before using it.
This skill appears to implement a legitimate remote crawler, but there are clear inconsistencies you should resolve before installing: (1) The package metadata says no env vars are required, but both SKILL.md and scripts/crawl.sh require TAVILY_API_KEY — do not run it without supplying and trusting that key. (2) Running the skill uploads crawled pages to api.tavily.com (full pages unless you request 'chunks') — avoid crawling private/internal sites unless you trust Tavily and understand their data retention/privacy policies. (3) The SKILL.md suggests storing the API key in ~/.claude/settings.json; consider storing credentials in a safer location or using short‑lived keys and rotate them. (4) If you want to avoid sending data externally, consider using a local crawler (wget, httrack, or a self-hosted crawler) instead. If you need help verifying the Tavily service (ownership, privacy policy, or whether the API key is required), request that information from the skill publisher before use.
Static analysis
Static analysis findings are pending for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.