Skill flagged — suspicious patterns detected
ClawHub Security flagged this skill as suspicious. Review the scan results before using.
Proxy Veil
v1.5.4Residential proxy for AI agents — fetch any URL through 2M+ real IPs, bypass anti-bot, geo-target, sticky sessions.
⭐ 0· 110·0 current·0 all-time
byMemijashi@goldentrii
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The name/description (residential proxy for AI agents) align with the declared functionality: provider credentials, API key for search, and a browser WebSocket for rendering JS-heavy pages are all plausible needs for this capability.
Instruction Scope
SKILL.md only instructs installing the proxy CLI (via npx) and calling proxy functions (fetch/render/search/session/status). It does not instruct reading unrelated local files or exfiltrating host machine data. Note: the functions allow fetching arbitrary URLs through external proxies, which is the intended behavior but increases privacy/risk surface.
Install Mechanism
No code files are included; runtime behavior depends on installing a node package (npx / npm). That is expected for a CLI but means arbitrary remote code will be executed on install. Also there is a small version mismatch: SKILL.md references 1.5.3 while registry metadata shows 1.5.4. Treat the install as a moderate-risk remote code download and verify the npm/GitHub package before running.
Credentials
requires.env lists many provider credentials (Novada, BrightData, Smartproxy, Oxylabs, PROXY_URL) as if all are required, but SKILL.md indicates you only need the credentials for the provider you choose. Declaring every provider credential as required is inconsistent and over-broad. Several declared secrets (NOVADA_API_KEY, NOVADA_BROWSER_WS) are sensitive: API keys and browser WebSocket endpoints grant external services the ability to perform searches and control a remote browser context. Only provide credentials you trust, and avoid reusing high-privilege or long-lived secrets.
Persistence & Privilege
always is false and the skill does not request modification of other skills or system-wide agent settings. Installing the CLI will create a binary, which is normal for a tool of this type.
What to consider before installing
This skill is coherent with being a proxy/CLI client, but exercise caution before installing: 1) The skill will install code from npm via npx — verify the npm package and GitHub repo (read the source and recent release notes) before running. 2) Only provide credentials for the single provider you intend to use; do not paste organization-wide or high-privilege keys. 3) NOVADA_BROWSER_WS (a browser WebSocket) and API keys are sensitive — treat them like secrets and rotate them if exposed. 4) Run the install in an isolated environment (container or dedicated VM) first to inspect behavior. 5) The metadata is sloppy (lists all provider creds as required and shows a version mismatch); ask the publisher to clarify which env vars are actually mandatory. If you cannot audit the package/source, consider alternative, well-audited tools or using a vetted proxy provider directly rather than installing this CLI.Like a lobster shell, security has layers — review code before you run it.
latestvk971m6pmn9m6bwrgg0k7w5vfbs84g2pp
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
OSmacOS · Linux · Windows
Any binnode, npx
EnvNOVADA_PROXY_USER, NOVADA_PROXY_PASS, NOVADA_API_KEY, NOVADA_BROWSER_WS, BRIGHTDATA_USER, BRIGHTDATA_PASS, SMARTPROXY_USER, SMARTPROXY_PASS, OXYLABS_USER, OXYLABS_PASS, PROXY_URL
Primary envNOVADA_PROXY_USER
Install
Node
Bins: proxy-veil