facequet

PassAudited by ClawScan on May 1, 2026.

Overview

The skill is a simple, disclosed web-scraping helper that fetches a user-provided URL and extracts text, with no evidence of credential use, persistence, hidden execution, or data exfiltration.

This appears safe for its stated purpose, but it will fetch whatever URL is provided. Use it only for pages you are allowed to access, avoid private/internal URLs, and pin dependencies if installing them yourself.

Findings (2)

Artifact-based informational review of SKILL.md, metadata, install specs, static scan signals, and capability signals. ClawScan does not execute the skill or run runtime probes.

Note

ASI02: Tool Misuse and Exploitation

What this means

Using the skill sends a request to the supplied website and returns extracted page text; only provide URLs you intend the agent to access.

Why it was flagged

The skill makes an outbound HTTP request to a user-provided URL. This is expected for a web reader, but users should recognize that it can contact arbitrary sites, not only Facebook.

Skill content

parser.add_argument("--url", required=True, help="URL trang cần đọc") ... r = requests.get(url, headers=DEFAULT_HEADERS, timeout=12)

Recommendation

Keep use user-directed, avoid sensitive/internal URLs, and consider adding domain allowlisting if the skill is intended to read only Facebook pages.

Note

ASI04: Agentic Supply Chain Vulnerabilities

What this means

If dependencies are installed from this file, the exact versions may vary between installations.

Why it was flagged

The dependency names are listed without pinned versions. These are common, purpose-aligned libraries, but unpinned installs can change over time.

Skill content

requests
beautifulsoup4

Recommendation

Pin dependency versions or use a lockfile for reproducible installs.