StripFeed

Fetch any URL as clean, AI-ready Markdown with token counts and caching. Strip ads, nav, scripts, and noise from web pages.

This skill appears to do what it says: it calls an external API to convert web pages to cleaned Markdown and needs an API key. Before installing, consider: (1) privacy — any URL you give it (including pages behind auth or with private querystrings) will be sent to stripfeed.dev; don't send sensitive internal pages or pages with secrets. (2) API key provenance — only use a key you control and understand the service's terms/privacy policy (https://www.stripfeed.dev). (3) autonomous use — if you allow agents to call skills autonomously, limit scope or require confirmation so the agent doesn't accidentally send many or sensitive URLs. (4) test with public pages first and monitor usage/rate limits. If you need to avoid third-party exposure, ask whether a self-hosted or local HTML-to-Markdown approach would be more appropriate.

Type: OpenClaw Skill Name: stripfeed Version: 1.0.0 The skill is classified as suspicious due to the inherent risk of shell injection. The `SKILL.md` defines `curl` as a required binary and provides examples where user-controlled input (specifically the `url` and `selector` parameters) is interpolated into `curl` commands. If the OpenClaw agent's execution environment does not properly sanitize or escape these user-provided arguments before executing the shell command, it could lead to arbitrary command execution (RCE) by a malicious user. This represents a significant vulnerability, even though the skill itself does not explicitly instruct the agent to perform malicious actions.