TinyFish Web Agent

Use TinyFish web agent to extract/scrape websites, extract data, and automate browser actions using natural language. Use when you need to extract/scrape dat...

This skill appears to be a front-end for a remote scraping service (TinyFish) and its instructions require installing an npm CLI and providing an API key (TINYFISH_API_KEY), but the registry metadata did not declare those requirements. Before installing or using it: (1) verify the publisher and the npm package (@tiny-fish/cli) on the npm registry — inspect its source repo and recent releases; (2) confirm the service endpoint (agent.tinyfish.ai) and read its privacy/data retention policy (scraped page contents will be transmitted to that service); (3) do not use your personal or sensitive credentials/pages with the skill unless you trust the service; (4) ask the skill author to correct registry metadata to list TINYFISH_API_KEY as a required credential and provide a homepage/source repo; (5) consider installing/testing the CLI in an isolated environment or container first. The primary inconsistency is the undisclosed credential requirement and implied remote upload of scraped content — that makes this skill suspicious, not conclusively malicious.

Type: OpenClaw Skill Name: tinyfish-web-agent Version: 1.0.3 The skill bundle provides instructions for an AI agent to use the TinyFish CLI for web searching, content extraction, and browser automation. The SKILL.md file contains legitimate documentation, usage patterns, and command examples (e.g., search, fetch, agent run) that align with the stated purpose of a web agent. No evidence of data exfiltration, malicious execution, or harmful prompt injection was found; the tool uses standard authentication via API keys and interacts with the tinyfish.ai domain.