Webfetch Md

Fetch any webpage and convert its main content into clean Markdown format, preserving image links and resolving relative URLs.

This skill appears to do exactly what it says: fetch a provided URL and convert the main content to Markdown using cheerio and turndown. Before installing or enabling it for autonomous agents, consider: (1) runtime Node version — cheerio notes Node >= 20.18.1 in package metadata, so ensure compatibility; (2) network risk — the skill can fetch any URL you pass it, so do not let untrusted prompts cause the agent to fetch internal URLs or sensitive endpoints (SSRF/internal network exposure); (3) dependency hygiene — the package uses standard npm dependencies from the public registry; you may want to run npm audit or review package-lock.json if you require higher assurance; (4) run tests locally first (node test.js <url>) to verify behavior and output; (5) if you plan to allow autonomous invocation, restrict or validate URLs the agent may fetch to avoid unintended access to internal services or confidential endpoints.

Type: OpenClaw Skill Name: webfetch-md Version: 1.1.0 The skill's core functionality involves making network requests to arbitrary URLs provided by the user or agent via `fetch` in `index.js`. While this capability is essential for its stated purpose of fetching web pages, it introduces an inherent Server-Side Request Forgery (SSRF) risk if the OpenClaw agent operates within an environment that has access to sensitive internal networks. There is no evidence of malicious intent, such as data exfiltration, persistence mechanisms, or shell injection vulnerabilities in `cli.js` or `SKILL.md`.