WrynAI Skill
v1.0.0Perform advanced web crawling and content extraction with multi-page crawling, search result parsing, pattern filtering, and screenshot capture using the Wry...
⭐ 0· 1.2k·0 current·0 all-time
by@wrynai
MIT-0
Download zip
LicenseMIT-0 · Free to use, modify, and redistribute. No attribution required.
Security Scan
OpenClaw
Suspicious
medium confidencePurpose & Capability
The SKILL.md clearly describes a WrynAI web-crawling skill (crawl, search, screenshots, content extraction) which is coherent with the skill name, but the package metadata gives no description or homepage and lists no required environment variables or primary credential. That mismatch (no declared env vars vs SKILL.md requiring WRYNAI_API_KEY) is unexpected and reduces trust in the metadata.
Instruction Scope
The instructions are focused on crawling/searching tasks and do not instruct the agent to access unrelated files or credentials. They do, however, tell the agent to read an environment variable (WRYNAI_API_KEY) and to pip install the 'wrynai' package — both are within the expected scope for a third-party SDK but the env var is not declared in the registry metadata.
Install Mechanism
There is no formal install spec in the registry; the SKILL.md instructs users to run 'pip install wrynai'. Instruction-only skills are lower risk, but pip-installing an external package can execute arbitrary code at install time. There is no link to a PyPI package or authoritative repo in the metadata to verify the package identity.
Credentials
The SKILL.md requires a single API key (WRYNAI_API_KEY), which is proportionate for a hosted SDK. However the declared requirements list in the registry is empty (no required env vars, no primary credential). That inconsistency is a red flag — the skill will need an API key to function, but the registry does not advertise that requirement.
Persistence & Privilege
The skill is instruction-only, does not request 'always: true', and does not ask to modify system or other skill configurations. It does not request elevated persistence or platform-wide privileges.
What to consider before installing
This skill appears to be a client wrapper for the WrynAI web-crawling service and legitimately needs an API key and the WrynAI Python package. Before installing or providing an API key: 1) Verify the WrynAI service (https://wryn.ai) and the identity of the 'wrynai' PyPI package or repository (confirm package author, homepage, and release history on PyPI or GitHub). 2) Note the registry metadata omission: the skill metadata does not declare the WRYNAI_API_KEY requirement — treat that as a potential oversight and ask the publisher to correct it. 3) Remember that pip installs run code at install time; only install packages from trusted sources. 4) Consider the data-flow risk: crawled content will be sent to the WrynAI service (the API key will authenticate those requests). If you will crawl sites with sensitive content, verify the service's privacy and retention policies. 5) If you need stronger assurance, request the skill publisher add a homepage, explicit required env vars/primary credential in metadata, and a formal install spec (or provide the SDK code) so you can audit the exact behavior.Like a lobster shell, security has layers — review code before you run it.
latestvk977v5gam2xzc6zaek6067c0kh80pchw
License
MIT-0
Free to use, modify, and redistribute. No attribution required.