Browser Automation

Browser automation using SkillBoss API Hub's web scraping capability to render web pages and extract clean, readable content.

Security Scan

The skill's behavior (sending arbitrary URLs and page content to a third‑party API) is coherent with its stated purpose, but the package metadata omits the required API key and the runtime allows fetching arbitrary/internal URLs which can lead to data exfiltration or SSRF; review before installing.

Purpose & Capability

The skill's name and description (headless browser via SkillBoss API Hub) match the code and SKILL.md: the runtime POSTs to a /v1/pilot endpoint to render pages. However, registry metadata declares no required environment variables while both README.md, SKILL.md, and index.js require SKILLBOSS_API_KEY — a clear mismatch in declared requirements.

Instruction Scope

SKILL.md and index.js allow the agent to read arbitrary URLs and send them to api.heybossai.com for rendering. There are no in-skill restrictions on target hosts (no whitelist or internal-host protection), so using this skill could cause the agent to disclose internal endpoints or sensitive page content to the remote service (server-side request forgery / data exfiltration risk). The instructions do not limit what the agent may fetch.

Install Mechanism

No install spec and no external downloads — this is an instruction-only skill with a small JS file. That reduces supply-chain risk compared with remote installers.

Credentials

The code expects a single credential SKILLBOSS_API_KEY (documented in README and SKILL.md) but the registry metadata lists no required env vars or primary credential. Requiring an API key is reasonable for the described capability, but the metadata omission is misleading and prevents the platform/user from properly evaluating secret exposure. The skill also transmits arbitrary page content to the third party, so the API key grants that service the ability to fetch and receive possibly sensitive data.

Persistence & Privilege

Skill flags are default (not always-included). The skill does not request elevated or persistent system privileges and does not alter other skills' configs.

What to consider before installing

This skill will send any URL you ask it to read (and the rendered page content) to https://api.heybossai.com/v1/pilot using the SKILLBOSS_API_KEY. The registry metadata failed to list that required API key — verify the key name and origin before supplying it. Consider these precautions before installing: - Only provide SKILLBOSS_API_KEY if you trust the api.heybossai.com operator and their privacy/security practices. - Avoid using the skill to fetch private/internal URLs (localhost, 169.254.169.254, internal hostnames) because that can leak secrets or enable SSRF. - If possible, restrict the agent to public URLs or add an allowlist on your side. - Inspect the code and response handling yourself; confirm the remote service's privacy policy and retention practices for scraped content. - If you cannot validate the vendor, run the skill in an isolated environment or refuse to set the API key.

This skill uses SkillBoss API Hub's web scraping capability to render web pages and extract clean, readable content.

This is a custom skill generated by SkillBoss to handle headless web browsing. It utilizes the SkillBoss API Hub (/v1/pilot) to navigate to websites and scrape data for the agent's context.

Usage

skillboss browser read <url> - Renders the page and returns its text content.

Features

• Headless browser automation
• Web page rendering
• Clean content extraction
• SkillBoss API integration

Requirements

• SkillBoss API access
• Valid API key

License

MIT