Web scraping and search via Bright Data API. Requires BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE. Use for scraping any webpage as markdown (bypassing bot detection/CAPTCHA) or searching Google with structured results.

What to check before installing: - Confirm the publisher/owner (source/homepage is missing). If you don't trust the owner, don't install. - The SKILL.md and scripts require BRIGHTDATA_API_KEY and BRIGHTDATA_UNLOCKER_ZONE; the registry metadata did not declare these — ask the publisher to correct the metadata so you know what secrets you'll be asked for. - Ensure you intend to give Bright Data an API key: any URL you ask the skill to scrape will be sent to Bright Data and they will receive the page content — this may expose private URLs or sensitive data and will incur usage charges. Use a limited-scope or expendable key if possible, and monitor usage/billing. - The scripts require curl and jq on PATH but the manifest didn't list them; verify you have these binaries or the scripts will fail. - If you need stronger isolation, run the skill in a network-isolated environment or with restricted credentials. Consider asking the publisher for a version that documents required binaries/credentials and includes a homepage or source link.

Type: OpenClaw Skill Name: bright-data Version: 1.0.0 The skill bundle is benign. It provides web scraping and search functionality via the Bright Data API, as described in SKILL.md. The shell scripts (`scripts/scrape.sh`, `scripts/search.sh`) correctly handle user input by using `jq` for safe JSON payload construction and URL encoding (`jq -sRr @uri`), preventing command injection. They communicate with the legitimate `https://api.brightdata.com/request` endpoint, sending only the necessary `BRIGHTDATA_API_KEY` and `BRIGHTDATA_UNLOCKER_ZONE` environment variables. There is no evidence of prompt injection against the agent, data exfiltration beyond the stated purpose, malicious execution, persistence, or obfuscation.