Fetch Url

Fetch raw HTTP response bodies from one or more URLs with optional custom headers and timeout, supporting JSON, XML, RSS, CSV, plain text, and files.

Security Scan

The skill's code and instructions are consistent with its stated purpose (fetching raw HTTP responses), but there are a few operational mismatches and expected risks (ability to fetch arbitrary URLs / internal endpoints) you should be aware of before installing.

Purpose & Capability

The name/description match the included script: the skill fetches raw HTTP responses for one or more URLs with optional per-URL headers and timeout. Minor mismatch: SKILL.md metadata declares 'node' as a required binary, but the registry metadata lists no required binaries; package.json declares a dependency (user-agents) so Node.js and dependencies are required at runtime.

Instruction Scope

SKILL.md instructs the agent to run the included Node script which only performs network fetches and prints results. The instructions and script do not read environment variables or local files. However, the skill will fetch arbitrary URLs provided by the caller — that means it can access internal endpoints (localhost/169.254.169.254, internal APIs) and return their contents. This is expected for a fetch tool but is a privacy/SSRF risk if untrusted inputs are allowed.

Install Mechanism

There is no install spec (instruction-only), which is low risk, but the package.json/package-lock indicate an npm dependency (user-agents). No install step is provided to install node_modules; the runtime therefore requires Node.js 18+ and that dependencies be available in the environment. This operational gap (no declared required binary in registry, no install step) may cause runtime failures or lead integrators to install dependencies manually.

Credentials

The skill requests no environment variables, no credentials, and does not access config paths. That is proportionate to its purpose.

Persistence & Privilege

always is false and the skill does not request persistent system or agent-wide modifications. It does not modify other skills or system configuration.

Assessment

This skill appears to do what it says (fetch HTTP responses). Before installing: ensure the runtime provides Node.js 18+ and that the dependency (user-agents) is installed or vendored, because there is no install step included; verify the registry metadata correctly lists 'node' as a required binary. Most importantly, treat input URLs as sensitive: the skill will fetch arbitrary targets you pass it — avoid giving untrusted inputs that could point to internal services (localhost, cloud metadata endpoints such as 169.254.169.254) or file:// URLs. If you plan to enable autonomous invocation, consider restricting which hosts/paths the skill is allowed to fetch or requiring user confirmation for remote URLs to reduce SSRF/data-exfiltration risk.

Fetch raw HTTP responses from URLs. Supports multiple URLs and custom headers.

Usage

# Single URL
node {baseDir}/scripts/fetch.mjs "https://api.example.com/data"

# Multiple URLs
node {baseDir}/scripts/fetch.mjs '["https://api.example.com/data1", "https://api.example.com/data2"]'

# With custom headers (per-URL)
node {baseDir}/scripts/fetch.mjs '["https://api.example.com/json", "https://api.example.com/text"]' '[{"accept":"application/json"}, {"accept":"text/plain"}]'

# With timeout
node {baseDir}/scripts/fetch.mjs "https://api.example.com/data" --timeout 60000

Examples

JSON API

# GitHub API - get repository info
node {baseDir}/scripts/fetch.mjs "https://api.github.com/repos/microsoft/vscode" '{"accept":"application/json","user-agent":"Mozilla/5.0"}'

XML

# SOAP service or XML endpoint
node {baseDir}/scripts/fetch.mjs "https://api.example.com/soap" '{"accept":"application/xml"}'

# Sitemap
node {baseDir}/scripts/fetch.mjs "https://example.com/sitemap.xml"

RSS / Atom Feed

# RSS 2.0 feed
node {baseDir}/scripts/fetch.mjs "https://example.com/rss.xml" '{"accept":"application/rss+xml"}'

# Atom feed
node {baseDir}/scripts/fetch.mjs "https://example.com/atom.xml" '{"accept":"application/atom+xml"}'

CSV / Plain Text

# CSV data
node {baseDir}/scripts/fetch.mjs "https://example.com/data.csv" '{"accept":"text/csv"}'

# Plain text
node {baseDir}/scripts/fetch.mjs "https://example.com/robots.txt" '{"accept":"text/plain"}'

Multiple Formats

# Fetch JSON and XML in parallel
node {baseDir}/scripts/fetch.mjs '["https://api.example.com/data.json", "https://api.example.com/data.xml"]' '[{"accept":"application/json"}, {"accept":"application/xml"}]'

Options

• urls_json: JSON array of URLs or a single URL string
• headers_json: Optional JSON array of headers objects (same length as urls)
• --timeout <ms>: Request timeout in milliseconds (default: 30000)

Notes:

• Returns raw HTTP response body
• For multiple URLs, returns JSON array of results
• Node.js 18+ required (native fetch)