Automates web and API data extraction with cleaning, formatting, scheduling, proxy support, retries, deduplication, and real-time monitoring.

This package looks sloppy rather than actively malicious: the README and marketing promise many advanced features that are not implemented in the shipped script. Before installing or using it, consider: 1) Don't expect proxy pools, retries, dedupe, scheduling, or monitoring — they are not implemented. 2) Test in an isolated directory or sandbox (not your home or repo root) because the script will write files to ./output. 3) Run it manually with a safe public URL to confirm behavior and network calls (it uses curl to fetch whatever URL you supply). 4) If you need the advertised features, ask the author for an explanation or implementation, or inspect/modify the script to add proper flag parsing, retries, proxy usage, and safe path handling. 5) Because the SKILL.md examples use flag syntax but the script uses positional args, avoid automated/production use until the interface is fixed. If you require higher assurance (e.g., for sensitive data), do not install this skill until the mismatches are resolved and the author provides audited code.

Type: OpenClaw Skill Name: ai-data-scraper Version: 1.0.0 The `main.sh` script contains a critical shell injection vulnerability. The `$URL` and `$API_URL` variables are directly used within `curl -sL "$URL" --compressed` without proper sanitization, allowing an attacker to inject arbitrary shell commands if they can control the input URL. While the script's stated purpose is benign (data scraping), this flaw enables remote code execution. Additionally, the script has functional bugs, including a mismatch in argument parsing between `main.sh` and `SKILL.md`/`package.json`, and calls to undefined `log_info`/`log_error` functions, which would cause it to fail.