TinyFish Web Agent
v1.0.2Use TinyFish web agent to extract/scrape websites, extract data, and automate browser actions using natural language. Use when you need to extract/scrape data from websites, handle bot-protected sites, or automate web tasks.
⭐ 3· 2.9k·4 current·4 all-time
bySimantak Dabhade@simantak-dabhade
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md and included script both require a TINYFISH_API_KEY and call https://agent.tinyfish.ai, which is coherent with the stated purpose. However, the registry-level Requirements summary in the provided metadata claims 'Required env vars: none' — this is an internal inconsistency that should be corrected or explained.
Instruction Scope
Runtime instructions are narrowly scoped to calling the TinyFish API via curl and to verify the TINYFISH_API_KEY before proceeding. The skill does not instruct the agent to read unrelated system files or other credentials. Note: the agent will send page content (the thing being scraped) to the TinyFish service — expected for a scraper, but this means scraped data (which may include PII or secrets) is transmitted off-host.
Install Mechanism
This is instruction-only with one small helper script; no install spec, no external downloads, and no archives are extracted. The included bash script simply builds a JSON payload and calls the documented API endpoint.
Credentials
Only one credential (TINYFISH_API_KEY) is used/required by the SKILL.md and script, which is proportional to the described remote API usage. However, the registry metadata omitted this requirement, creating ambiguity about expected credentials.
Persistence & Privilege
The skill does not request always: true and has no special persistence or ability to modify other skills or global agent settings. It runs on demand and uses normal network calls.
What to consider before installing
This skill appears to do what it says: send scraping requests to TinyFish using a TINYFISH_API_KEY. Before installing, consider the following:
- Confirm the credential mismatch: the SKILL.md and script require TINYFISH_API_KEY, but the top-level metadata omitted it. Ask the publisher to correct the manifest or explain why it's missing.
- Data exfiltration risk: scraped pages (HTML, form responses, etc.) are sent to agent.tinyfish.ai. If you intend to scrape pages that contain sensitive data (credentials, PII, private endpoints), do not use this skill unless you have explicit permission and trust the TinyFish service and its privacy/security controls.
- Legal/ethical risk: the 'stealth' browser_profile and proxy options explicitly enable evading bot protections and geolocation restrictions. Using those features can violate site terms of service or local law—review the target site's terms and applicable law before use.
- Verify publisher/trust: the Source is unknown; check the homepage, documentation, and publisher identity (owner ID) before entrusting API keys. Prefer storing API keys in secure vaults rather than in plaintext files; if using the suggested Claude-specific settings file, be aware that file-level storage may expose secrets to other local processes.
- If you need confidentiality, consider running your own scraper or a self-hosted alternative so scraped data never leaves your environment.
If the publisher provides more information (official docs, privacy/security policy, or an updated registry manifest that includes the TINYFISH_API_KEY requirement), re-evaluate — that could raise confidence toward 'benign'.Like a lobster shell, security has layers — review code before you run it.
latestvk97dcf89cb0ae9487w52wcv3q180x73x
License
MIT-0
Free to use, modify, and redistribute. No attribution required.