Opengraph Io

Extract web data, capture screenshots, scrape content, and generate AI images via OpenGraph.io. Use when working with URLs (unfurling, previews, metadata), capturing webpage screenshots, scraping HTML content, asking questions about webpages, or generating images (diagrams, icons, social cards, QR codes). Triggers: 'get the OG tags', 'screenshot this page', 'scrape this URL', 'generate a diagram', 'create a social card', 'what does this page say about'.

This skill appears to do what it says: call OpenGraph.io APIs using your OPENGRAPH_APP_ID and curl. Before installing or configuring: 1) Verify the OpenGraph.io service and dashboard URL are correct and that you trust the provider. 2) Keep your OPENGRAPH_APP_ID secret — prefer setting it as an environment variable rather than embedding it in project files or shared configs (.vscode, repo files). 3) If you run the optional MCP helper (npx opengraph-io-mcp), review that npm package/source first because npx will execute code from npm. 4) Be aware the service provides proxy options to access geo-restricted content; using proxies may have legal/terms-of-service implications for target sites — ensure you have the right to scrape those pages. 5) If you want minimal exposure, avoid adding the key to multiple client config files and instead rely on per-host environment variables or dedicated, revocable keys. Overall the skill is internally consistent and coherent with its stated purpose.

Type: OpenClaw Skill Name: opengraph-io-skill Version: 1.4.0 The skill is classified as suspicious due to its reliance on `npm` and `npx` to install and execute the `opengraph-io-mcp` package globally with the `-y` (yes to all prompts) flag, as seen in SKILL.md and references/mcp-clients.md. While this is for installing its own component, executing remote code with automatic confirmation poses a significant supply chain risk if the `opengraph-io-mcp` package itself were compromised. Additionally, the skill's API capabilities include advanced web scraping features like `full_render` and `use_proxy` (documented in references/api-reference.md and references/platform-support.md), which, while aligned with the stated purpose, represent powerful capabilities that could be misused. There is no clear evidence of intentional malicious behavior such as data exfiltration to unauthorized endpoints or prompt injection attempts to subvert the agent's core function within the provided files.