Fetch static webpage content up to 5000 characters via HTTP/HTTPS GET for analysis, summarization, or information extraction.

This skill appears to do what it says (fetching static HTTP/HTTPS pages and truncating to 5000 chars), but there are a few issues to consider before installing: 1) The SKILL.md promises robots.txt compliance but the code does not implement it — if you require crawling policy enforcement, ask the author to add a robots check. 2) The tool will fetch any URL you give it; that enables SSRF-like access to internal network services or cloud metadata endpoints reachable from the agent. If this is sensitive in your environment, run the skill in a network-restricted sandbox or add an allowlist/blocklist for hosts/IP ranges. 3) The timeout logic can produce false 'request timeout' errors because the timer isn't cleared on success — this is a reliability bug. 4) Registry/package version mismatch (registry 1.0.5 vs package.json 1.0.1) is a minor integrity flag — consider asking the publisher for clarification. If you decide to use it, test in an isolated environment and request the maintainer to fix robots.txt handling, add host restrictions, and correct the timeout handling.

Type: OpenClaw Skill Name: emily-web-fetch Version: 1.0.5 The skill provides a tool to fetch web content via HTTP/HTTPS, but the implementation in index.js lacks any URL validation or IP blacklisting. This creates a significant Server-Side Request Forgery (SSRF) vulnerability, potentially allowing the agent to access internal network resources or metadata services (e.g., 169.254.169.254). While the behavior aligns with the stated purpose in SKILL.md and there is no evidence of intentional malice, the high-risk nature of unconstrained network requests warrants a suspicious classification.