OpenClaw URL Tailwind Scaffold
Security checks across malware telemetry and agentic risk
Overview
The skill's code, instructions, and requirements match its stated purpose (fetch a URL, parse static HTML, and produce a Tailwind scaffold); nothing requested or installed appears disproportionate or unrelated to that purpose.
This plugin is internally consistent with its description: it fetches the URL you provide, parses the static HTML, and returns a Tailwind scaffold or page contract. Be aware of two practical risks: (1) SSRF/exfiltration — because it will fetch any URL you pass, do not give it internal URLs or sensitive endpoints if your agent runtime can access private networks; (2) returned payloads may include parts of fetched HTML in the analyzer output, so fetched content will be visible in the skill output. If you plan to run this in a shared or highly privileged environment, restrict the skill's network access or only allow it to fetch public URLs you control. Otherwise, the package appears coherent and proportionate for its stated purpose.
SkillSpector
SkillSpector findings are pending for this release.
VirusTotal
No VirusTotal findings
