Marktplaats

Search Marktplaats.nl classifieds across all categories with filtering support.

This package appears to be a straightforward Marktplaats search CLI and JS client that only fetches data from marktplaats.nl and requires Node 18+. Before installing: (1) ensure you have Node 18+ available (SKILL.md and package.json require it); (2) review the full src/api.js (the provided bundle here was truncated) especially implementations of getListingDetails and fetchCategories to confirm they only fetch/parse marktplaats pages and do not call other domains or read local files; (3) run the CLI locally (npm install -g . or npx) and inspect network activity if you have concerns; and (4) prefer installing from a trusted source (npm registry or a verified repository) rather than an unknown package bundle. If you can provide the complete src/api.js (no truncation), I can raise my confidence to high after re-checking the remaining code paths.

Type: OpenClaw Skill Name: marktplaats Version: 0.3.0 The skill is classified as suspicious due to the `getListingDetails` function in `src/api.js`. This function accepts a `urlOrPath` parameter and will fetch any `http` or `https` URL if the input starts with either protocol. While intended for Marktplaats listing details, this broad network access could be exploited for Server-Side Request Forgery (SSRF) to probe internal networks or access unauthorized external resources if an attacker can control the input (e.g., via prompt injection against the agent or crafted CLI arguments). There is no explicit malicious intent like data exfiltration or remote code execution, but the capability to make arbitrary outbound requests is a significant risk.