ToolDeck

Auto-scrapes URLs to extract tool/service info, auto-categorizes, and saves to a personal database. Use when user explicitly shares a URL to save or asks to...

Security Scan

The skill's requested capabilities, runtime instructions, and storage behavior are internally consistent with its stated purpose of scraping user-shared URLs and saving tool metadata; nothing requested is disproportionate or unrelated.

Purpose & Capability

Name/description (auto-scrape, categorize, save tools) match the SKILL.md workflow. The skill asks for no credentials, no binaries, and no unusual system access — all consistent with a passive, user-initiated bookmarking/scraping tool.

Instruction Scope

Instructions are narrowly scoped to user-initiated actions: confirm intent, use web_fetch and web_search, respect robots.txt, skip authenticated/paywalled/private pages, sanitize tracking params, present for confirmation before saving. They do not instruct reading arbitrary local files or accessing unrelated credentials. Note: because this is an instruction-only skill (no executable code), the behavior depends on the agent following these textual rules.

Install Mechanism

There is no install spec and no code files to install or execute. This minimizes installation risk — nothing is downloaded or written during install.

Credentials

The skill requests no environment variables or credentials, which is appropriate. One proportionality note: it writes a persistent database file in the agent workspace (/workspace/skills/tooldeck/references/database.json) and may store extracted contact info (emails, locations). That persistent storage is expected for the stated purpose but is sensitive and worth user consideration.

Persistence & Privilege

always is false and autonomous invocation is not disabled (normal). The skill will persist user-provided data into a workspace file; this is reasonable for a bookmarking database but means saved entries are stored persistently and could be accessible to other users or skills with access to the same workspace. The skill does not request elevated platform privileges or attempt to modify other skills.

Assessment

This skill appears coherent and limited to user-initiated scraping and saving of tool/service URLs. Before installing, consider: (1) The skill saves extracted data persistently at /workspace/skills/tooldeck/references/database.json — review or delete that file if you stop using the skill. (2) Although the SKILL.md explicitly forbids scraping private or paywalled pages and says it will strip tokens and tracking params, enforcement depends on the agent following those textual rules (there's no code to audit). If you care about strict guarantees, test the skill with non-sensitive example URLs and inspect the database file to confirm only expected data is stored. (3) Be mindful that saved entries can include public contact info (emails/links) and may be visible to others with access to the same workspace. If these considerations are acceptable, the skill's behavior is proportionate to its purpose.

ToolDeck - Personal Service/Tool Database

Trigger

Use this skill when:

1. User shares a URL and explicitly asks to save it
2. User asks to "save" or "remember" a service or tool they provided
3. User asks "what tools do I have for X"
4. User explicitly requests tool suggestions for a project

Privacy first: Never scrape, save, or monitor URLs without explicit user request. The skill is entirely passive — it only acts when the user intentionally asks it to.

What It Does

User provides a URL with intent to save → scrape → extract info → categorize → confirm → save to database

Workflow

1. Saving a Tool (User-Initiated Only)

Step 1: Confirm intent

• Only proceed if user explicitly asked to save a URL
• Never auto-save from casual browsing or project context

Step 2: Scrape the URL

• Use web_fetch to get page info
• Extract: title, description, pricing, features, logo
• Respect robots.txt — do not scrape pages that disallow it
• Skip authenticated/private pages — do not attempt to scrape pages behind login walls, paywalls, or CAPTCHAs

Step 3: Auto-categorize

• Analyze content to detect category:
  • AI/ML - AI services, LLMs, machine learning
  • Development - Coding tools, APIs, frameworks
  • Productivity - Task management, notes, workflow
  • Marketing - SEO, social media, ads
  • Design - Graphics, UI/UX, video
  • Finance - Billing, accounting, payments
  • Communication - Messaging, email, calls
  • Data - Analytics, databases, visualization
  • Other - Anything else

Step 4: Find social media

• Search for LinkedIn, Facebook, Instagram, Twitter
• Use web_search with tool name + "social media"

Step 5: Auto-generate tags

• Extract keywords from description
• Common tags: free, paid, api, no-code, ai, etc.

Step 6: Confirm and save

• Present the extracted info to the user
• Only save after user confirms
• Confirm: "Saved: [title] ([category])"

2. Retrieving Tools

• By category: "Show me all AI tools"
• By search: "Find something for PDF"
• Full list: "List all my saved tools"

3. Tool Suggestions (Opt-In Only)

• Only suggest tools when the user explicitly asks for project help
• Do not proactively monitor or inject suggestions during normal chat

Content Boundaries

Never scrape:

• Pages behind login, paywall, or authentication
• Pages blocked by robots.txt
• Private/intranet URLs
• URLs containing personal data (icloud, google drive shared links, etc.)

Sanitization:

• Do not store OAuth tokens, API keys, or session IDs if present in URLs
• Strip tracking parameters (utm_*, fbclid, etc.) from URLs before saving

Database Location

/workspace/skills/tooldeck/references/database.json

Format

{
  "tools": [
    {
      "url": "https://example.com",
      "title": "Tool Name",
      "description": "What it does",
      "category": "Development",
      "tags": ["python", "api", "free"],
      "use_case": "For building APIs",
      "notes": "Good alternatives to X",
      "saved_date": "2026-04-04",
      "price": "Free / $X/mo",
      "social_media": {
        "linkedin": "...",
        "facebook": "...",
        "instagram": "..."
      },
      "contact": {
        "email": "...",
        "location": "..."
      }
    }
  ]
}