Deep Validator
v2.5.1Validate email addresses and URLs with real network checks (DNS MX, DNSBL, disposable domain detection, HTTP reachability, redirect chain tracing). Use whene...
⭐ 1· 143·1 current·1 all-time
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Benign
high confidencePurpose & Capability
Name/description promise (DNS MX, DNSBL, disposable checks, HTTP reachability, redirect tracing) aligns with the SKILL.md and README: all guidance describes calling an external microservice (hosted at https://deep-validator-production.up.railway.app) which performs the network checks. No agent-side binaries, env vars, or installs are requested, which is appropriate for a remote API.
Instruction Scope
Runtime instructions direct the agent to POST email/URL data to the operator's API and to follow an x402 payment handshake. This necessarily transmits user-provided emails/URLs to the external service (expected for this purpose). The SKILL.md includes a consent gate (confirmed=false returns a free quote) which mitigates unwanted charges; however, calling with confirmed=true will trigger the payment flow — agents (if allowed to act autonomously) could therefore initiate paid validations. The skill does not instruct the agent to read unrelated local files or secrets.
Install Mechanism
Instruction-only skill with no install spec and no code files included. This is the lowest-risk install profile — nothing is written to disk by the skill itself.
Credentials
No agent-side environment variables or credentials are required to call the hosted endpoint. The README and SKILL.md list server-side env vars required to self-host (NVM_API_KEY, NVM_PLAN_ID_EMAIL, NVM_PLAN_ID_URL, optional DEEP_VALIDATOR_API_KEY, WEBHOOK_SECRET) — these are reasonable for an operator running the service and are not requested from callers.
Persistence & Privilege
The skill does not request permanent/always-on inclusion. It permits autonomous invocation (disable-model-invocation=false), which is platform-default; combined with the ability to trigger confirmed=true it could cause automated paid calls if an agent is allowed to run without human consent. This is a behavioral risk to manage via agent policy rather than an incoherence in the skill.
Assessment
This skill appears internally consistent and does what it claims: it sends emails/URLs to an external validation API that charges via the x402/Nevermined flow. Before installing or enabling autonomous use: (1) confirm you are comfortable sending potentially sensitive emails/URLs to the hosted operator (host: https://deep-validator-production.up.railway.app, operator contact in metadata), (2) prefer calling with confirmed=false first so you can show users the cost quote and only proceed on explicit consent, (3) if you allow autonomous pipelines, ensure they are pre-authorized for the expected small per-call cost or disallow confirmed=true, (4) if self-hosting, protect NVM_API_KEY and DEEP_VALIDATOR_API_KEY and consider replacing the in-memory rate limiter for horizontal scaling, and (5) optionally review the referenced source code (GitHub link in metadata) to verify behavior and webhook signature handling.Like a lobster shell, security has layers — review code before you run it.
latestvk971ssn73gz44eqtbc710sjnvs8400zw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.
Runtime requirements
🔍 Clawdis