Website Auditor

Audit any website across 8 quality signals to determine if it is outdated, broken, or neglected. Returns a structured audit dict used by the lead-scorer skill.

This skill appears to implement a reasonable website auditor, but there are a few practical and privacy issues you should resolve before installing: - Metadata mismatch: SKILL.md declares a required environment variable (PAGESPEED_API_KEY) and lists Python packages, yet the registry entry lists no required env or install steps. Ask the publisher to correct the registry metadata or provide a clear install spec so you know what the skill needs and why. - Dependencies: The skill imports non-standard Python packages (Wappalyzer, python-whois, lxml). If your agent environment doesn't already have these, the skill will fail. Prefer an install spec (pip/packaging) or run the skill in a sandboxed environment. - Raw HTML disclosure: The skill returns raw_html and documents it will be consumed by another skill. That can leak sensitive content (forms, tokens in page markup, private data). Confirm how downstream skills handle that data and whether you are comfortable with the coupling. - Credential handling: Only provide a PAGESPEED_API_KEY if you trust the skill. The key is appropriate for the feature, but the registry mismatch means the platform may not prompt you to supply it. - Network activity: The skill performs active network probes (HTTP fetches, SSL cert checks, whois, third-party API calls). If you need to limit outbound network access, run this skill in a restricted/sandboxed context. If you cannot get clarification from the publisher, consider treating the skill as untrusted: run it in an isolated environment, do not supply privileged credentials, and audit any downstream consumers that will receive raw_html.

Type: OpenClaw Skill Name: website-auditor Version: 1.0.0 The skill's stated purpose is to audit websites, and its core functionality aligns with this. However, the `audit_website_async` function in `SKILL.md` uses `aiohttp.TCPConnector(ssl=False)` when fetching website content. This disables SSL certificate verification for the underlying connection, making the client vulnerable to Man-in-the-Middle attacks during the initial data fetch. While a separate `check_ssl` function attempts to verify the target site's SSL, the `raw_html` and headers could be compromised during the `aiohttp` request, representing a critical security vulnerability rather than intentional malicious behavior.