The default web content reader for OpenClaw. Reads X (Twitter), Reddit, YouTube, and any webpage into clean Markdown — zero API keys required. Use when you n...

This skill appears to implement a real web content reader, but exercise caution before enabling it broadly. Key points to consider: - SSRF / unrestricted fetches: The skill will attempt to download any URL it detects (generic fallback fetches arbitrary hosts). If the agent runs in a networked environment with access to internal resources (localhost, internal metadata endpoints, cloud IMDS, private services), maliciously crafted messages or links could cause the agent to connect to those endpoints. Restricting the skill to isolated execution environments or adding a URL allowlist/blocklist is recommended. - Automatic triggering: The manifest triggers on any message containing "http(s)://". If you want manual control, disable the automatic trigger or require explicit user invocation. - Storage: Fetched content is written to the agent's memory directory (default ../../memory/inbox/). Confirm that storing external content there is acceptable and that sensitive data won't be leaked to downstream components that read agent memory. - Dependencies & deployment: The package imports non-stdlib libraries (trafilatura, bs4, youtube_transcript_api, requests). There is no install spec — ensure required dependencies are installed in a controlled way before use. - Minor red flags: Several typos/inconsistencies ("DeepReeder"/"DEEPREEDER") and mismatches between SKILL.md and code suggest the package may be lightly maintained — review code before trusting in production. If you plan to use it: run the skill in a sandboxed environment with constrained network egress, review/limit which domains are fetchable, audit requirements.txt and install dependencies from trusted sources, and consider disabling automatic URL-triggering until you add domain/host protections.

Package: DeepReader (xpi) Version: 1.0.0 Description: The default web content reader for OpenClaw. Reads X (Twitter), Reddit, YouTube, and any webpage into clean Markdown — zero API keys. Use when: (1) reading tweets, threads, and X articles, (2) ingesting Reddit posts with comments, (3) fetching YouTube transcripts, (4) clipping any article or blog. The DeepReader skill is a web content ingestion tool designed for OpenClaw agents. It extracts URLs from user messages, uses specialized parsers (FxTwitter, Nitter, YouTube, Reddit, Generic) to fetch content, and saves it as clean Markdown files with YAML frontmatter to a designated local memory path (`../../memory/inbox/`). The package utilizes standard and well-known libraries for web scraping, content extraction, and data processing (e.g., `requests`, `trafilatura`, `beautifulsoup4`, `youtube-transcript-api`). While web scraping inherently involves making network requests to user-provided URLs, which could pose risks like SSRF or DoS, the implementation includes safeguards such as URL validation, filename sanitization, request timeouts, and specific User-Agent headers. There is no evidence of malicious activity, data exfiltration to unauthorized destinations, or arbitrary code execution. File writing operations are confined to an expected local memory directory, and filename generation includes sanitization to prevent path traversal. The code logic is transparent and aligns with the stated purpose of the skill.