Webclaw Hybrid Engine Ln
Security checks across static analysis, malware telemetry, and agentic risk
Overview
The skill's purpose (local web scraping) is coherent, but its runtime instructions force use of a local npm-run service (npx webclaw-hybrid-engine-ln), block fallback to built-in fetchers, and encourage installing/running unvetted code — this combination is concerning.
This skill is internally coherent as a local scraping gateway, but it strongly pushes you to run an npm package (npx webclaw-hybrid-engine-ln) and will block the agent from using built-in fetchers if that local service isn't running. Before installing or running anything from npm: 1) Verify the package on the npm registry (publisher, download counts, source repo), 2) Inspect the package source or repo to confirm behavior and no unexpected network/file operations, 3) Prefer running it in an isolated environment (container, VM) if you must evaluate it, 4) If you cannot verify the package, do not run the npx command — instead use the agent's built-in web_fetch/browse options or a known-safe scraper. If you want, I can help locate the npm package, inspect its repository, or suggest safer alternatives for fetching and rendering web pages.
Static analysis
No static analysis findings were reported for this release.
VirusTotal
No VirusTotal findings
Risk analysis
No visible risk-analysis findings were reported for this release.